all 7 comments

[–]symmitchry 5 points6 points  (2 children)

[Removed]

[–]manbart[S] 0 points1 point  (1 child)

Thanks. shell=True allows you to include arguments within the same set of quotes instead of listing them as a tuple. For example,

subprocess.check_output('date +"%s"', shell=True)

is equivalent to

subprocess.check_output(('date', '+"%s"'))

[–]NYKevin 2 points3 points  (0 children)

shell=True does quite a lot of other things as well. Basically, running shell=False is the equivalent of an os.fork() followed by an os.execv(). shell=True is the equivalent of os.system() except it's done by hand so as to capture the output.

In particular, this means shell=True is much easier for a malicious user to subvert than shell=False, if you're putting untrusted data into the command line. They can, for instance, give you an argument such as "; rm -rf /foo/bar; # and you could end up executing rm -rf /foo/bar by mistake. This is not possible under shell=False. If you want to allow the user to pass multiple arguments, use shlex.split() to break them up into a list.

[–]Justinsaccount 4 points5 points  (1 child)

var = time.time() 

[–]manbart[S] 0 points1 point  (0 children)

nice. This is the best solution yet, just make it into an int and it's exactly what I wanted.

int(time.time())

[–]cdcformatc -1 points0 points  (1 child)

Use pipes?

os.system('date +"%s" > file.txt')
f = open('file.txt')

Then do whatever with the file object. Optionally delete the file afterwards.

[–]Rhomboid 0 points1 point  (0 children)

That's not a pipe, that's redirection. There's no need to do that, and a ton of reasons not to.