Escaping is difficult to get right, especially in PHP... witness things like magic quotes that existed for so long. The right thing to do is provide an output

Escaping is difficult to get right, especially in PHP... witness things like magic quotes that existed for so long. The right thing to do is provide an output capturing API that does not require escaping because it takes a list of strings passed to the exec(2) system call.