Is there a reason why the "winbox-args" code has not been adopted into the PHP source code for escapeshellarg()?

------=_Part_71684_1382672702.1598280360017
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

I have valid file names such as:

E:\videos\Happy Fun Time!.mp4

If I do:

if (file_exists('E:\videos\Happy Fun Time!.mp4'))

Then PHP "sees" the file; it exists. Good.

However, if I try to actually use the file's path, for example by sending it in a command:

shell_exec('test.exe --input=' . escapeshellarg('E:\videos\Happy Fun Time!.mp4'));

... then the test.exe receives/is sent:

test.exe --input="E:\videos\Happy Fun Time .mp4"

escapeshellarg() has turned the "!" into a space, thus making the path no longer valid.

I know that you do this for security reasons, and that proper escaping on Windows is something of a nightmare. Nevertheless, this means that PHP is fundamentally broken on Windows, since I cannot refer to any file containing a "!" and other valid characters.

How can it be that `file_exists` is able to safely check for its existence, even with the "!"? Does `file_exist` have some internal code which safely and properly checks all valid file names, whereas `escapeshellarg()` for some reason lacks this?

In desperation, I have adopted this minimal library: https://github.com/johnstevenson/winbox-args/blob/master/src/Args.php

It doesn't seem like a *huge* amount of code, but I have no idea how safe this is. It *appears* to work in all my tests, but that says little.

Are the PHP developers unaware of this fix? How come it hasn't been incorporated into the PHP project? If the answer is "backwards compatibility and people rely on these bugs", why not call it "real_escapeshellarg()" or something?

Basically, why do I need to trust some random guy's third-party code to do a crucial task in PHP? It feels really bad, both because of security concerns, but also because it's almost like PHP is seen by its developers as some kind of dead legacy thing. Yet you also make many real improvements all the time. It makes no sense to me. Why has this important and basic thing apparently been ignored for so long?

Please don't tell me to "submit a bug". I'm wondering why so many others, who must know about this, have never cared enough to fix it. Maybe the code I linked to is horribly wrong in some way? That's fully possible. This is kind of my point: I just have to trust this guy to know what he's doing. He might himself be ignorant (and me too) of something which makes his code fall apart and opens my entire system up to a horrible security hole.

As much as Windows is annoying and bad, I really like the idea that PHP is (supposed to be) platform-independent, and that my PHP code will (or should) work regardless of which OS I might be using or forced to use or will switch to in the future. I don't like it when there are "varying levels of support" like this, with some things feeling "half-baked" or neglected on Windows.


------=_Part_71684_1382672702.1598280360017--