escapeshellcmd(3) [php man page]

ESCAPESHELLCMD(3)							 1							 ESCAPESHELLCMD(3)

escapeshellcmd - Escape shell metacharacters

SYNOPSIS

       string escapeshellcmd (string  $command)

DESCRIPTION

       escapeshellcmd(3)  escapes  any	characters in a string that might be used to trick a shell command into executing arbitrary commands. This
       function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec(3) or system(3)
       functions, or to the backtick operator.

	Following characters are preceded by a backslash: #&;`|*?~<>^()[]{}$, x0A and xFF.  ' and " are escaped only if they are not paired. In
       Windows, all these characters plus % are replaced by a space instead.

PARAMETERS

	      o $command
		- The command that will be escaped.

RETURN VALUES

	The escaped string.

EXAMPLES

       Example #1

	      escapeshellcmd(3) example

	      <?php
	      // We allow arbitrary number of arguments intentionally here.
	      $command = './configure '.$_POST['configure_options'];

	      $escaped_command = escapeshellcmd($command);

	      system($escaped_command);
	      ?>

       Warning

	      escapeshellcmd(3) should be used on the whole command string, and it still allows the attacker to pass  arbitrary  number  of  argu-
	      ments. For escaping a single argument escapeshellarg(3) should be used instead.

SEE ALSO

       escapeshellarg(3), exec(3), popen(3), system(3), backtick operator.

PHP Documentation Group 													 ESCAPESHELLCMD(3)

PREG_QUOTE(3)								 1							     PREG_QUOTE(3)

preg_quote - Quote regular expression characters

SYNOPSIS

       string preg_quote NULL (string  $str, [string  $delimiter])

DESCRIPTION

       preg_quote(3)  takes $str and puts a backslash in front of every character that is part of the regular expression syntax. This is useful if
       you have a run-time string that you need to match in some text and the string may contain special regex characters.

	The special regular expression characters are: .  + * ? [ ^ ] $ ( ) { } = ! < > | : -

PARAMETERS

	      o $str
		- The input string.

	      o $delimiter
		- If the optional $delimiter is specified, it will also be escaped. This is useful for escaping the delimiter that is required	by
		the PCRE functions. The / is the most commonly used delimiter.

RETURN VALUES

	Returns the quoted (escaped) string.

CHANGELOG

       +--------+--------------------------------+
       |Version |				 |
       |	|				 |
       |	|	   Description		 |
       |	|				 |
       +--------+--------------------------------+
       | 5.3.0	|				 |
       |	|				 |
       |	|  The - character is now quoted |
       |	|				 |
       +--------+--------------------------------+
EXAMPLES

       Example #1

	      preg_quote(3) example

	      <?php
	      $keywords = '$40 for a g3/400';
	      $keywords = preg_quote($keywords, '/');
	      echo $keywords; // returns $40 for a g3/400
	      ?>

       Example #2

	      Italicizing a word within some text

	      <?php
	      // In this example, preg_quote($word) is used to keep the
	      // asterisks from having special meaning to the regular
	      // expression.

	      $textbody = "This book is *very* difficult to find.";
	      $word = "*very*";
	      $textbody = preg_replace ("/" . preg_quote($word, '/') . "/",
					"<i>" . $word . "</i>",
					$textbody);
	      ?>

NOTES

       Note

	      This function is binary-safe.

SEE ALSO

       PCRE Patterns, escapeshellcmd(3).

PHP Documentation Group 													     PREG_QUOTE(3)