note 2799 deleted from escapeshellcmd by jmoore

This function is almost always a waste of time. Normally you know what program you want to run and you want to change the parameters to it based on user input. For example: $cmd = '/usr/local/bin/myprog --param1="'.$input."'"; This $input must be quoted, but NOT by escapeshellcmd, but by a function that is sadly missing from PHP (surprise, surprise) - one that escapes ONLY double-quote, backslash and back-tick. You will have to write this yourself. If you use escapeshellcmd things like & and ' will be quoted and you will get extra s sent to your program.