3 ms·
PHP provides escapeshellcmd / escapeshellarg functions for escaping when building commands. Is there any shell on which those functions are unsafe ? I think th
by fooyc 14y ago
PHP provides escapeshellcmd / escapeshellarg functions for escaping when building commands.
Is there any shell on which those functions are unsafe ? I think they assume cmd.exe on windows and sh on others.
- thwarted 14y agoEscaping is difficult to get right, especially in PHP... witness things like magic quotes that existed for so long. The right thing to do is provide an output capturing API that does not require escaping because it takes a list of strings passed to the exec(2) system call.