Is this script safe?

I need to execute some server tasks. Now I heard many many times this is very insecure. This is my solution:

Added this line to sudoers: www-data ALL=NOPASSWD: /var/private-www/bin/webadmin (Not accessible through web)

Created this script var/private-www/bin/webadmin:

# Script for executing server tasks.
#
# Arguments:
#  - Password       Required for authentication, not all scripts may run this file
#  - Action         Action to execute
# Exit codes:
#  0                Failed
#  1                Success

# First of all check the password
if [ $1 = "secretpassword" ]
then

whoami
exit 1

else

echo "No access"
exit 0

fi

The file has these rights: 0111

SSH access is only enabled for one account. So nobody can execute the script, except me (and www-data). www-data can now access this file by doing: exec('/usr/bin/开发者_如何学Gosudo /var/private-www/bin/webadmin secretpassword', $output, $status);

Is this safe enough? How can I make it more secure?

I'm thinking that if your Apache server gets cracked, someone could access that script and execute it, but I might be wrong.

I've came across a resource you might want to read about, especially when it comes to restricting your script to your internal network.

http://www.linuxsecurity.com/content/view/133913/171/

I hope this answers your question.