#43784 [Opn]: escapeshellarg removes % from given string

ID: 43784 Updated by: derick@php.net Reported By: bate@php.net Status: Open Bug Type: Program Execution Operating System: Windows PHP Version: 6CVS-2008-01-08 (snap) New Comment: This is because of the following commit: http://cvs.php.net/viewvc.cgi/php-src/ext/standard/exec.c?r1=1.84.2.13&r2=1.84.2.14 which was a reaction to a security bulletin. However, just stripping out the % is not the solution, as it can only be used to access env vars *outside* strings, and with a matching %. However, just stripping them out is not a good solution as it hinders real life use of it like in this example. Previous Comments: ------------------------------------------------------------------------ [2008-01-08 09:04:37] bate@php.net Description: ------------ escapeshellarg(string) removes all % out of it. This results in a non working version for arguments that requires % for formating. ie. imagick identify.exe identify -format "%m" myimage.png Reproduce code: --------------- <?php echo escapeshellarg('%m %f %v'); Expected result: ---------------- '%m %f %v' Actual result: -------------- ' m f v' ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=43784&edit=1