The crazy thing is that there is a correct escaping available: `escapeshellarg()`. With correct escaping, you don't even need to sanitize the user input here -

The crazy thing is that there is a correct escaping available: `escapeshellarg()`. With correct escaping, you don't even need to sanitize the user input here - the target command will parse the MAC address itself and report any errors. The existing code is analogous to building SQL queries using string concatenation and forgetting the mysqli_real_escape_string() call. Really the solution is to use a parameterized interface (e.g. by calling pcntl_fork() + pcntl_exec(), that accepts an array of arguments instead of a string command-line). Pcntl doesn't seem to have a wrapper for the posix_spawn syscall.