Re: Bug #3519: EscapeShellCmd is never useful

Rasmus Lerdorf <rasmus@php.net> wrote: > If the user input is: 2';ls > > The full command ends up being: > > cal 2000 '2\'\;ls' > > That's perfectly fine and doesn't make the 'ls' execute. It doesn't make the 'ls' execute, but it does make the command line invalid (missing "'") and you are now relying on the shell detecting this and refusing to execute the command line (otherwise the user at the very least can pass two arguments instead of one, and this in itself may be enough for them to perform arbitrary commands). -- \/ Jon Ribbens / jon@oaktree.co.uk