note 19524 added to function.escapeshellarg

I suggest that you use some variation of this to clean your user-submitted inputs: $arg = preg_replace ("/[^A-Za-z0-9]/","",$arg); This function will remove any characters that you do not expect from the user. Add any legal characters that you expect in the input to the regular expression. -- http://www.php.net/manual/en/function.escapeshellarg.php http://master.php.net/manage/user-notes.php?action=edit+19524 http://master.php.net/manage/user-notes.php?action=delete+19524 http://master.php.net/manage/user-notes.php?action=reject+19524