I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified.
// Get user input
$monochromeThreshold = $_POST['monochromeThreshold'];
$originalFile = $_POST['originalFile'];
$monochromeLocation = $_POST['monochromeLocation'];
// Create command
$command = 'convert -density 150 -threshold ' . $monochromeThreshold . '% -fuzz 1% -transparent white ' . $originalFile . ' ' . $monochromeLocation;
// Execute command
$out = system($command);
Is there a way to sanitize the user input or take other actions prevent injection into the terminal with confidence?