The unnecessary "from user input" qualification is why spaces are kryptonite for most shell-based tools. It doesn't matter where input comes from. Input needs

The unnecessary "from user input" qualification is why spaces are kryptonite for most shell-based tools. It doesn't matter where input comes from. Input needs to be escaped for the context it's used in, period. Non-exploitable doesn't mean it's correct.