note 41819 added to function.escapeshellarg

NOTE: If you are using PHP >= 4.2 you should use the pcntl_* (Process Control) functions instead of this hack. PHP, before version 4.2, didn't provide any execl(3)-like or execv(3)-like methods to invoke external programs, thus everything goes trough /bin/sh -c and we are forced to quote arguments. To make it worse escapeshellarg() behaves badly (IMHO) with an empty string: <?php echo "mime-construct --to ".escapeshellarg($to)." --cc a@a.com"; ?> The following function is a wrapper to system(), and it can be adapted to popen(),exec(),shell_exec(): <?php # system with perl? semantics function lib_system() { $arg=func_get_args(); if(is_array($arg[0])) $arg=$arg[0]; $cmd=array_shift($arg); foreach($arg as $i) { $cmd.=" ''".escapeshellarg($i);; } system($cmd); } # example1 lib_system("mime-construct","--output", "--to",$a,"--string",$b); # example2 lib_system(array("mime-construct","--output", "--to",$a,"--string",$b)); ?> ---- Manual Page -- http://www.php.net/manual/en/function.escapeshellarg.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+41819 Delete -- http://master.php.net/manage/user-notes.php?action=delete+41819&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+41819&report=yes Search -- http://master.php.net/manage/user-notes.php