It depends on the shell you use and how your file names are handled. Bash is a clusterfuck waiting to happen when it comes to file names, but not all shells wo

It depends on the shell you use and how your file names are handled. Bash is a clusterfuck waiting to happen when it comes to file names, but not all shells would be at risk here. For example the shell I maintain would be fine because file names are tokenised like how variables are tokenised in SQL strings when using parametrised queries (to use your SQL/PHP example).