<p>In modules/exec/doc/exec_admin.xml:</p>
<pre style='color:#555'>&gt; +                        &lt;para&gt;&lt;emphasis&gt;error&lt;/emphasis&gt; - pseudovariable where to store the error from
&gt; +                        the standard error of the process.
&gt; +                        &lt;/para&gt;
&gt; +                &lt;/listitem&gt;
&gt; +                &lt;listitem&gt;
&gt; +                        &lt;para&gt;&lt;emphasis&gt;envavp&lt;/emphasis&gt; - Avp where to store the values for the
&gt; +                        environment variables to be passed for the command. The names of the environment
&gt; +                        variables will be &quot;OSIPS_EXEC_#&quot; where # will start from 0. For example if you
&gt; +                        store 2 values into an avp (&quot;a&quot; and &quot;b&quot;) OSIPS_EXEC_0 will contain the first value
&gt; +                        and OSIPS_EXEC_1 the second value.
&gt; +                        &lt;/para&gt;
&gt; +                &lt;/listitem&gt;
&gt; +                &lt;/itemizedlist&gt;
&gt; +                &lt;para&gt;
&gt; +                WARNING: any OpenSIPS pseudo-vars which may contain special bash
&gt; +                characters should be placed inside quotes, e.g. exec(&quot;update-stats.sh &#39;$ct&#39;&quot;);
</pre>
<p>This does not help. You need to quote the contents of $ct too, or else I could do this:</p>

<pre><code>Contact: &lt;sip:'; rm -rf /; echo '@whatever.com&gt;
</code></pre>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br>Reply to this email directly or <a href="https://github.com/OpenSIPS/opensips/pull/375/files#r19524753">view it on GitHub</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/AFOciYOUUjR2gGkqV73DxoOlccc-s_Mmks5nIJ8PgaJpZM4Cz-_8.gif" width="1" /></p>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"View this Pull Request on GitHub","action":{"@type":"ViewAction","url":"https://github.com/OpenSIPS/opensips/pull/375/files#r19524753","name":"View Pull Request"}}</script>