note 69868 added to ref.zip

Previous poster's code is not using escape_shell_arg(), so it can be a huge security hole if attacker could manipulate filename/dir. I suggest replacing str_replace() with sprintf() and escape_shell_arg(). ---- Server IP: 195.136.184.34 Probable Submitter: 84.92.248.233 ---- Manual Page -- http://www.php.net/manual/en/ref.zip.php Edit -- https://master.php.net/note/edit/69868 Del: integrated -- https://master.php.net/note/delete/69868/integrated Del: useless -- https://master.php.net/note/delete/69868/useless Del: bad code -- https://master.php.net/note/delete/69868/bad+code Del: spam -- https://master.php.net/note/delete/69868/spam Del: non-english -- https://master.php.net/note/delete/69868/non-english Del: in docs -- https://master.php.net/note/delete/69868/in+docs Del: other reasons-- https://master.php.net/note/delete/69868 Reject -- https://master.php.net/note/reject/69868 Search -- https://master.php.net/manage/user-notes.php