Displaying The Website Uptime In Php Help required in displaying the website uptime on my staff status page

[sportytalk 0]

I have decided that on one of the staff pages on my website, I'd like to include the uptime of the website, which I assume would be the uptime of the Xisto server.

I've read a couple of tutorials on the internet and the system uptime works, but there's also another method which supposedly does the same thing. The problem is, this other method has had discussion about whether or not this method displaying the uptime is secure. I read on another site that some servers tend to block this php function from being used.

The methods which I found were

system("uptime")

which seemed to work on here and

shell_exec('uptime')

which I haven't tried as I wasn't sure whether it was a secure enough function to run on the Xisto forum. The site at which I found the php tutorial had a forum in which one of the registered members said he thought there may be a security vulnerability in using the exec function and it was said by someone else that some servers block exec from being used.

I'm really not sure which to use, or whether it's worth actually displaying the uptime in the first place.
Does anyone know the difference between these two methods? Which method would be the best one to use?

[rvalkass 5]

The two work slightly differently. Shell_exec, as the name suggests, executes a command on the shell and gives you the output. This is disabled by most free hosts as they run PHP in safe mode. Xisto is one of the very few that do not run in safe mode and give us access to the full power of PHP. The system function executes a program rather than a shell command and is therefore deemed safer. Really, you need not worry which you are using unless your script is taking user input, in which case you should use system for security.As to whether it is worth displaying the uptime, are your staff going to benefit from it? It is useful for us to know as webmasters so we can apologise to users for any downtime and to know how reliable the host is. It only takes a millisecond to appear and won't really impact loading times, so its up to you as to whether you think it is necessary or useful.

[Saint_Michael 3]

Did some searching and found some scripts that follow those two commends

http://www.4webhelp.net/scripts/php/uptime.php

<?php  $data = shell_exec('uptime');  $uptime = explode(' up ', $data);  $uptime = explode(',', $uptime[1]);  $uptime = $uptime[0].', '.$uptime[1];  echo ('Current server uptime: '.$uptime.'');?>

Although this is a stupid question since I most likely know the answer to. wouldn't the chmodding to 755 of either commands not be successful in preventing any security leaks or would a system wide hack compromise that chmod?

[rvalkass 5]

I think the main way that the script creates security problems is if any user input is accepted as a string, which could run some malicious code via the shell. It would require that they knew how your script was working, but a CHMOD would have no effect. Then again, there is no harm in locking down your files as much as possible.

[CrazyRob 0]

what you can do is download a php script which displays the server uptime. Do you want to have a complete server uptime system? as then you could check different ports on the servers like port 80 and then also get the script to display the total uptime. the command you need to use for this is fsockopen command - it will check a certain port on a server. here is an example

$http = @fsockopen(80, 4);		if (!$http) {			$http = "images/red.gif";		} else {			fclose($http);			$http = "images/green.gif";		} 

That piece of code will check port 80 which is the http port and check if it working and if it is then it will display a green image and if its down it will display a red image.

To get the total server uptime so far you can use Saint_Michael's example but im not sure if it will work

[sportytalk 0]

Thanks for the replies.I'm not fussed in having a complete uptime system, just something simple. Having just the uptime in days, hours, minutes and possibly seconds would be good enough. It's just to go on the staff status page so the staff and myself know if the site's been down so we can apologize to the users.Thanks for the code St. Michael. However, it has been said that there is a security issue in using the shell_exec function. The first reply of this topic states that there isn't really an issue if user input isn't taken but i'm really not sure. Different webpages and different people say different things.Is there a security issue if I just display the uptime in text?. I don't want to use this function at all if Xisto don't want it used or if it could make my website or the Xisto vulnerable. My scripts would not be taking any user input. The uptime would be displayed in text form in the way mentioned at the top of this post (Days, hours, minutes, seconds).If the system command runs a program on Xisto, if many people view the page at the same time, wouldn't that then flood Xisto with this program being executed?I'm really not sure which function to use. Both seem to have their advantages and disadvantages. If there are vulnerabilities in both functions, I'd rather just use my third method, which was to forget about displaying the uptime.

Edited December 29, 2006 by sportytalk (see edit history)

[Saint_Michael 3]

Wouldn't setting up a php url mask over scripts put a somewhat better security included using a combination of htaccess and some other password stuff keep it somewhat more secure?

[electron 0]

Hey this is really cool .I was in search of that script for such a long time and i had wasted a hell lot of time on this uptime stuff.Thanks a lot for giving that code.Also shell execution is really a good feature in PHP.I love it but doesn't it work if the safe mode is on.So your script might not work altogether.Weill try this script immediately in safe mode and without it.Thanks and have a good day.