As many wrote, this is a well known problem. Running any commands on external user input is prone to similar attacks. When doing it, one should strongly conside

As many wrote, this is a well known problem. Running any commands on external user input is prone to similar attacks. When doing it, one should strongly consider going through an API that will prevent such command execution. And I would go for a standard/well known library for the language used instead of a homegrown one. That said, I often use such code myself for simple tasks that I run on a local machine. The simplicity of calling a shell, internal pipes and all of its options, is great. If and when I need to polish it or especially expose this to other users I can rewrite it properly. My 2c.