#40928 [NEW]: escapeshellarg() does not quote percent (%) correctly for cmd.exe

From: frode at coretrek dot com Operating system: Windows Server 2003 PHP version: 5.2.1 PHP Bug Type: Program Execution Bug description: escapeshellarg() does not quote percent (%) correctly for cmd.exe Description: ------------ On win32, the function escapeshellarg() replaces percent characters (%) with spaces. Instead, the function should escape the percent character, perhaps using the ^% construct, so that the percent sign can be safely used as a an argument to an application executed through exec(). Reproduce code: --------------- <? // .... This creates a directory called "Test dir" (without the quotes) // .... which is unexpected. $cmd = 'md'; $arg = 'test%dir'; $fullcmd = $cmd.' '.escapeshellarg($arg); // .... This creates a directory called "Test%dir" (without the quotes) // .... which is the expected result of the above. // $fullcmd = 'md test^%dir'; exec($fullcmd); system("dir /B"); ?> Expected result: ---------------- test%dir Actual result: -------------- test dir -- Edit bug report at http://bugs.php.net/?id=40928&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=40928&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=40928&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=40928&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=40928&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=40928&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=40928&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=40928&r=needscript Try newer version: http://bugs.php.net/fix.php?id=40928&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=40928&r=support Expected behavior: http://bugs.php.net/fix.php?id=40928&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=40928&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=40928&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=40928&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=40928&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=40928&r=dst IIS Stability: http://bugs.php.net/fix.php?id=40928&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=40928&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=40928&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=40928&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=40928&r=mysqlcfg