note 73169 added to function.escapeshellcmd

This function is great -- except when you need to legitimately use an escaped character as part of your command. The code below leaves the parts of the command that are enclosed within single quotes alone, but escapes the rest eg: "echo Never use the '<blink>' tag ; cat /etc/passwd" becomes: "echo Never use the '<blink>' tag \; cat /etc/passwd" and not: "echo Never use the '\<blink\>' tag \; cat /etc/passwd" i.e, we really want the ';' escaped, but not the HTML tag. I really needed the code below in order to run the external ImageMagick's 'convert' command properly and safely... <?php // Escape whole string $cmdQ = escapeshellcmd($cmd); // Build array of quoted parts, and the same escaped preg_match_all('/\'[^\']+\'/', $cmd, $matches); $matches = current($matches); $quoted = array(); foreach( $matches as $match ) $quoted[escapeshellcmd($match)] = $match; // Replace sections that were single quoted with original content foreach( $quoted as $search => $replace ) $cmdQ = str_replace( $search, $replace, $cmdQ ); return $cmdQ; ?> ---- Server IP: 202.89.36.242 Probable Submitter: 203.109.172.162 (proxied: unknown) ---- Manual Page -- http://www.php.net/manual/en/function.escapeshellcmd.php Edit -- https://master.php.net/note/edit/73169 Del: integrated -- https://master.php.net/note/delete/73169/integrated Del: useless -- https://master.php.net/note/delete/73169/useless Del: bad code -- https://master.php.net/note/delete/73169/bad+code Del: spam -- https://master.php.net/note/delete/73169/spam Del: non-english -- https://master.php.net/note/delete/73169/non-english Del: in docs -- https://master.php.net/note/delete/73169/in+docs Del: other reasons-- https://master.php.net/note/delete/73169 Reject -- https://master.php.net/note/reject/73169 Search -- https://master.php.net/manage/user-notes.php