Bug #67864 [NEW]: escapeshellarg incorrectly escapes single quotes

From: Laurent dot Lyaudet at gmail dot com Operating system: Linux PHP version: master-Git-2014-08-19 (Git) Package: *General Issues Bug Type: Bug Bug description:escapeshellarg incorrectly escapes single quotes Description: ------------ Hi, Single quotes are not properly escaped by escapeshellargs. The correction is trivial. Current source code in exec.c is 363 switch (str[x]) { 364 #ifdef PHP_WIN32 365 case '"': 366 case '%': 367 cmd->val[y++] = ' '; 368 break; 369 #else 370 case '\'': 371 cmd->val[y++] = '\''; 372 cmd->val[y++] = '\\'; 373 cmd->val[y++] = '\''; 374 #endif 375 /* fall-through */ 376 default: 377 cmd->val[y++] = str[x]; 378 } line 371 should be removed and a line with 'break;' should be added between lines 373 and 374. Correct source code should be 363 switch (str[x]) { 364 #ifdef PHP_WIN32 365 case '"': 366 case '%': 367 cmd->val[y++] = ' '; 368 break; 369 #else 370 case '\'': 371 cmd->val[y++] = '\\'; 372 cmd->val[y++] = '\''; 373 break; 374 #endif 375 /* fall-through */ 376 default: 377 cmd->val[y++] = str[x]; 378 } Best regards, Laurent Lyaudet Test script: --------------- root@wheezyDEVLaurent:~# php <?php echo "\n", escapeshellarg('\''), "\n"; ?> ''\''' root@wheezyDEVLaurent:~# Expected result: ---------------- '\'' Actual result: -------------- ''\''' -- Edit bug report at https://bugs.php.net/bug.php?id=67864&edit=1 --