note 50229 added to function.exec

The note regarding how exec() works under safe_mode is wrong. echo y | echo x does not become echo "y | echo x". It essentially becomes echo "y" "|" "echo" "x". The entire string is passed through escapeshellcmd(), which effectively splits arguments at spaces. Note that this makes it impossible to reliably pass arguments containing spaces to exec() in safe_mode. Since 4.3.3 escapeshellcmd() tries to pass quoted arguments through (so you could try exec("cmd 'arg 1' 'arg 2'")), but not on win32, and will still wrongly backslash escape any punctuation characters inside the quotes. Not only can the path not contain '..' components, but no directory or filename can contain the string '..'. e.g. /path/to/my..executable will refuse to run. ---- Manual Page -- http://www.php.net/manual/en/function.exec.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+50229 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+50229&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+50229&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+50229&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+50229&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+50229&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+50229&report=yes Search -- http://master.php.net/manage/user-notes.php