Be more careful with host parameter and make sure it's escaped when call shell functions
Escape parameters passed to shell_exec()