note 52948 added to function.escapeshellarg

According to my test (PHP 4.3.10) there is no need to call escapeshellarg() on a filename that is being written to by proc_open, and probably others. E.g. <?php $process = proc_open("echo hi", array( 0 => array("pipe", "r"), 1 => array("file", 'filename with spaces', "w"), 2 => array("pipe", "w"), ), $pipes); ?> creates a file named: filename with spaces In fact, <?php 1 => array("file", escapeshellarg('filename with spaces') ?> creates a file named: 'filename with spaces' (quotes included in filename.) Maybe all the PHP functions that take a filename as a separate parameter work this way. I guess you just need to escape filenames when they are part of a single string command line such as with the backtick operator, system(), etc. ---- Manual Page -- http://www.php.net/manual/en/function.escapeshellarg.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+52948 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+52948&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+52948&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+52948&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+52948&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+52948&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+52948&report=yes Search -- http://master.php.net/manage/user-notes.php