PHP is developed and maintained by a global community of contributors.
The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
(PHP 4 >= 4.0.3, PHP 5, PHP 7, PHP 8)
escapeshellarg — Escape a string to be used as a shell argument
escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument. This function should be used to escape individual arguments to shell functions coming from user input. The shell functions include exec(), system() and the backtick operator.
On Windows, escapeshellarg() instead replaces percent
signs, exclamation marks (delayed variable substitution) and double quotes
with spaces and adds double quotes around the string.
Furthermore, each streak of consecutive backslashes (\)
is escaped by one additional backslash.
The behavior of this function with multibyte strings depends on the current
LC_CTYPE locale setting. Unrecognized characters will be
discarded. See setlocale().
argThe argument that will be escaped.
The escaped string.
Приклад #1 escapeshellarg() example
<?php
system('ls '.escapeshellarg($dir));
?>
