Shell escapes may be one of the most common escaping issues I see these days. Most programmers have gotten into their heads that they need to escape SQL and HTM

Shell escapes may be one of the most common escaping issues I see these days. Most programmers have gotten into their heads that they need to escape SQL and HTML but for some reason the most commonly used commands to start new executables use the shell and people bang strings together to build the argument strings. Languages/libraries should make it incredibly obvious which strings are passed to the shell and ideally would apply protections such as automatic escaping that is frequently done for HTML. But the thing that I don't get the most is that passing a list of arguments is easier than using the shell in a lot of cases. I frequently see people build a list of arguments then join it by spaces! Save yourself a step and just pass the list to `exec` directly.