Executing programs securely How do I exec thee? Let me count the ways: Good choices: execl( const char *path, const char *arg, ...); execle( const char *path, const char *arg , ..., char * const envp[]); execv( const char *path, char *const argv[]); Bad choices: /* doesn't have path hard coded - depends on $PATH variable */ execlp( const char *file, const char *arg, ...); execvp( const char *file, char *const argv[]); /* sends command to shell via "sh -c " -- if user input is included */ /* in the command, they may sneak shell metacharacters in */ /* use pipe / fork / exec instead */ system( const char *string); popen( const char *command, const char *type);