title: Is running a C as root dangerous when it uses system() and a user input?
body: <p>Basically what I want to achieve is running commands in a java console via php. The way I want to do this might be too far fetched, so if there is an easier way, please tell me.</p>
  
  <p>So what I had in mind is using <code>exec()</code> or <code>shell_exec()</code> in php to enter the commands via a tmux session. The problem is that apache runs on www-data, and that user can't create tmux sessions (for some reason).
  After searching on the internet for way too long I found <a href="https://stackoverflow.com/a/8532448/3625298">this</a>. A way to execute an application as root. Even when it's executed from another user. I tried this and this obviously works, but now I would like to run commands from php via arguments. But I'm not sure if this would be unsafe because of an injection. It does require user input after all. Or do I not have to worry about this as long as I use <code>escapeshellarg()</code> or <code>escapeshellcmd()</code> in php?</p>
  
  <p>Thanks in advance for the help :)</p>