In the general case, you cannot pass the user input through the shell because of the shell's escaping rules. What you should be doing is getting a handle on the newly spawned process's standard input stream and feed it directly.
You can use popen
to do this:
$handle = popen('/usr/bin/gateway', 'w');
fwrite($handle, $_POST['message']);
pclose($handle);
If you need to do more than the example shows and popen
does not provide enough functionality, proc_open
is a more involved and powerful alternative.
WARNING: Feeding unfiltered user input to an external process leaves you vulnerable to exploits related to how the process interprets and acts on this input. If your application is accessible to non-trusted users, strongly consider whitelisting the input!