Bug #68140 [Opn->Nab]: escapeshellarg doesn't escape double quotes, it removes them instead

Edit report at https://bugs.php.net/bug.php?id=68140&edit=1 ID: 68140 Updated by: ab@php.net Reported by: petrhudecek2010 at gmail dot com Summary: escapeshellarg doesn't escape double quotes, it removes them instead -Status: Open +Status: Not a bug Type: Bug Package: Program Execution Operating System: Windows 8.1 PHP Version: 5.6.1 Block user comment: N Private report: N New Comment: Yeah, that were pretty valid with bash. For cmd.exe you'd do like <?php $arg = escapeshellarg('echo \'hello\';'); echo php -r $arg; or i do it with $arg = escapeshellarg("echo 'hello';"); system(PHP_BINARY . " -r $arg"); The behavior is though correct - on Windows escaping seems to be not the shell task, but the one of a program you're working with. Some programs can "eat" it with "" (escape with another double quote) or ^". The common thing is however to have an argument enclosed with double quotes or even without them. So a normal inline code is like php.exe -r "echo 'hello';" on Linux you would replace double quotes with single quotes and vice versa, as double quotes could be possible extrapolated with a Linux shell like bash/dash/etc. Thanks. Previous Comments: ------------------------------------------------------------------------ [2014-10-04 11:02:03] petrhudecek2010 at gmail dot com I'm using this code (simplified from what I actually need, but shows the principle): <?php $arg = escapeshellarg('echo "hello";'); echo php -r $arg; I wanted it to print hello, instead it says that hello is not a defined constant because it strips the double quotes. ------------------------------------------------------------------------ [2014-10-04 10:15:25] ab@php.net What is the particular command you're running? Thanks. ------------------------------------------------------------------------ [2014-10-03 06:08:21] petrhudecek2010 at gmail dot com Description: ------------ On Windows, the function escapeshellarg quotes the string in double quotes but instead of escaping existing double quotes, it removes them instead. Test script: --------------- <?php echo escapeshellarg('"'); Expected result: ---------------- "\"" Actual result: -------------- " " ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68140&edit=1