I am working on a PHP-based website where the login form needs to authenticate against local users on the system via PAM - in other words, they should be able to login successfully if they enter a valid username and password for a local user account on the server. The website originally accomplished this using the php-auth-pam module, but since it has been deprecated, I am currently having to look around for an alternative solution. I eventually came across this answer with a helpful C script for authenticating against PAM. I successfully compiled it into an executable named chkpasswd, and to check a username/password combo I simply run:./chkpasswd username passwordIt outputs Authenticated if the credentials are valid, and Not authenticated if they are not. That part works like a charm, no problems there.But pretty soon I realized there was a glaring issue - this setup doesn't work properly when passwords contain special characters! It will say the user is not authenticated even when the credentials are correct. I am calling chkpasswd using PHP's exec() function, and using escapeshellarg() to escape the user input. Here's the PHP code:function pam_auth2($username, $password){    $result = exec(/usr/local/sbin/chkpasswd .escapeshellarg($username). .escapeshellarg($password));    if ($result == Authenticated){        return true;    }    else{        return false;    }}So here are my main questions:Is it possible to modify either the C script or the PHP code that calls it so that the system properly handles passwords with special characters?How secure is this setup overall? Are there any glaring vulnerabilities I should know about?
Calling a password checking command from PHP using exec() - how to escape user input?
php;c;pam;escape characters