Re: Is there a reason why the "winbox-args" code has not been adoptedinto the PHP source code for escapeshellarg()?

On 24.08.2020 at 16:45, [email protected] wrote:

> I have valid file names such as:
>
> E:\videos\Happy Fun Time!.mp4
>
> If I do:
>
> if (file_exists('E:\videos\Happy Fun Time!.mp4'))
>
> Then PHP "sees" the file; it exists. Good.
>
> However, if I try to actually use the file's path, for example by sendin=
g it in a command:
>
> shell_exec('test.exe --input=3D' . escapeshellarg('E:\videos\Happy Fun T=
ime!.mp4'));
>
> .... then the test.exe receives/is sent:
>
> test.exe --input=3D"E:\videos\Happy Fun Time .mp4"
>
> escapeshellarg() has turned the "!" into a space, thus making the path n=
o longer valid.
>
> I know that you do this for security reasons, and that proper escaping o=
n Windows is something of a nightmare. Nevertheless, this means that PHP i=
s fundamentally broken on Windows, since I cannot refer to any file contai=
ning a "!" and other valid characters.

Proper escaping on Windows isn't a nightmare =E2=80=93 it is impossible (a=
t
least without context).  See <https://ss64.com/nt/syntax-esc.html>,
especially the sections "Escaping the pipeline" and "Special Cases".

Anyhow, in most cases you don't need to have cmd.exe involved, and in
these cases escaping is way simpler, and readily available as of PHP
7.4.0 if you pass an array as first argument to proc_open() instead of a
string.

=2D-
Christoph M. Becker