# System() Methods in CGI Scripts Not Working

**URL:** <https://www.ruby-forum.com/t/system-methods-in-cgi-scripts-not-working/57035>\
**Category:** Ruby\
**Created:** [April 6, 2006, 6:11pm UTC](https://www.ruby-forum.com/t/system-methods-in-cgi-scripts-not-working/57035 "2006-04-06T18:11:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nko](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/91b2a8/32.png) [@nko](https://www.ruby-forum.com/u/nko)\
**Post date:** [April 6, 2006, 6:11pm UTC](https://www.ruby-forum.com/t/system-methods-in-cgi-scripts-not-working/57035/1 "2006-04-06T18:11:46Z")

</div>

There’s probably a very simple explanation for this, but here 'goes:

I have a few CGI scripts. A couple of them make system() calls to launch  
shell scripts. These scripts work fine on the command line, but when I  
launch the exact same script by visiting it in my browser, the page  
loads indefinitely.

I think this indicates a permissions problem. Is there anything I can do  
to circumvent this? The server I’m running on is one I don’t control.

---

<div class="post-metadata">

**Author:** ![nko](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/91b2a8/32.png) [@nko](https://www.ruby-forum.com/u/nko)\
**Post date:** [April 6, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/system-methods-in-cgi-scripts-not-working/57035/2 "2006-04-06T19:09:49Z")

</div>

Okay, after much searching, I’ve discovered that the string I’m passing  
to system() is tainted because it comes from POST data. I suppose  
entering “`rm *`” in to any field WOULD be bad news. Lesson learned!