> the execve family of functions are not drop-in replacements since they don't take care of forking, changing the signals, and waiting. Maybe not in C, but the

> the execve family of functions are not drop-in replacements since they don't take care of forking, changing the signals, and waiting. Maybe not in C, but they are a drop-in replacement in just about every scripting language. Perl, Ruby, Python, all have nice high level calls that mostly mimic system() but use execve underneath—You simply pass system() multiple arguments instead of a single string. `system("")` in your production web app server code is almost certainly incorrect. Sadly I think PHP still doesn't have this. > As long as you're not passing arguments from outside sources to the command, using system() should be OK. Very true, but think about whether you really need a shell to launch your command (are you using any shell features?). If not, why not just launch the command directly?