File Processing

How Command Injection Happens in PHP and How to Fix It

The ImportController.php file contained multiple instances of unsafe command execution using `shell_exec()` and `exec()` with external tools like `catdoc` and `pdftotext`. While the file paths were escaped using `escapeshellarg()`, the command names themselves remained non-constant, creating an exploit primitive that could be chained with other vulnerabilities. The fix eliminates these shell command execution patterns entirely.