As often as I've seen people get shell-escaping wrong, escaping rules probably aren't well-understood, regardless of how well-defined they are. Bourne shell's q

As often as I've seen people get shell-escaping wrong, escaping rules probably aren't well-understood, regardless of how well-defined they are. Bourne shell's quoting rules are byzantine at best. There are ways to reliably and securely quote for the Bourne shell, but the best solution is not to pass untrusted input to the shell. Unrelated to the shell, I've seen people -- including myself -- fail at dot-stuffing. Experience has taught me to avoid hand-rolled escaping when I can; escaping is definitely a code smell.