4 ms·
Escaping shell arguments is still fighting self-erected bugstacles. Why run the sub process in a shell in the first place? Why make a string out of your argumen
by km6GEwiQqsyEKQH 5y ago
Escaping shell arguments is still fighting self-erected bugstacles. Why run the sub process in a shell in the first place? Why make a string out of your argument list for the shell to parse it back to a list to finally call the process? Just exec the program directly with the argument list and do not escape anything. Just skip the dance of serializing your arguments to a string.
- __david__ 5y agoUnfortunately, PHP is the one scripting language that doesn't have direct exec() support! escapeshellarg() is the only tool they give you and it requires you to not shoot yourself in the foot. Even perl has multi arg system() that execs directly.
- pilif 5y agothere is pcntl_exec for that. Unfortunately it can be (and often is) disabled and thus not widely used.