Answer.

Interaction with external programs is a critically important feature of Perl, inherited since the language's creation in 1987 for system administration tasks and shell routine automation. Perl provides several ways to execute an external command: the system operator, backticks (``) or qx//, the open function with a pipe, and module wrappers like IPC::Open3.

The main challenge when launching external processes is to correctly capture the output (stdout and stderr), handle launch errors, ensure parameter safety (to avoid injections), and the distinction between synchronous and asynchronous execution.

The solution lies in choosing the correct method for the specific task. For simple commands, use system or backticks; for more complex cases, use IPC::* modules:

Example code (reading command output and handling errors):

my $command = 'ls -l /tmp';
my $output = qx{$command};
if ($? == -1) {
    die "Launch error: $!";
} elsif ($? & 127) {
    warn sprintf "Command terminated by signal %d", ($? & 127);
} else {
    print "Output: $output";
}

Key features:

Simultaneous interaction with stdin, stdout, stderr using open and IPC::Open3.
Not all methods ensure error return or allow safe variable substitution in commands.
For asynchronous scenarios, one must study modules like IPC::Run, Proc::Background, and control the process PID.

Tricky Questions.

What is the difference between system and exec in Perl?

Answer: system launches the command in an external process and returns control to Perl after completion, while exec completely replaces the current Perl process with the executed program; Perl code after it does not execute.

Example:

system('echo Hello');
exec('ls', '-l'); # That's it, the Perl script is replaced by ls, Perl does not continue

Can user variables be safely passed to shell commands?

Answer: Only when using an argument list (not a string) and avoiding interpolation in the shell. Otherwise, command injection is possible.

# Safe:
system("ls", "-l", $user_supplied_dir);
# Unsafe:
system("ls -l $user_supplied_dir");

How can both stdout and stderr be obtained from an external command?

Answer: A reliable way is to use IPC::Open3 or redirect stderr to stdout at the shell level:

my $out = qx{ls /notexists 2>&1};

or through IPC::Open3 (a more universal and fine-grained method).

Common Mistakes and Anti-Patterns

Passing unescaped variables in shell strings (injections).
Expecting a return value from system (it returns status, not output).
Mixing stdout and stderr without explicit control.

Real-life Example

Negative Case

An admin uses system("rm -rf $dir") with a user-provided value.

Pros:

Simple and quick to implement.

Cons:

Critical injection is possible (for example, if $dir contained "; rm -rf /;") — the entire system is deleted.

Positive Case

Using system('rm', '-rf', $dir), with $dir validated and logging implemented.