Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:21805
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <5C.0D.45475.01548E34@pb1.pair.com>
To: internals@lists.php.net
Date: Tue, 07 Feb 2006 17:58:29 +1100
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
MIME-Version: 1.0
References: <11392846379400000@9866357972520000.9866341568840000>
In-Reply-To: <11392846379400000@9866357972520000.9866341568840000>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [PATCH] Bug #34671 Incorrect callingconvention to cmd.exe
From: t.starling@physics.unimelb.edu.au (Tim Starling)

Frank M. Kromann wrote:
> I like the idea of a php.ini setting for the comspec (although this might
> create OS specific ini files), and I do not like 'magick' stuff happening
> to command parameters in any of the exec functions.
> 
> According to Windows cmd specifications the quotes are needed if one of
> the special characters is present in the command line.
> 
> The special characters that require quotes are:
>      <space>
>      &()[]{}^=;!'+,`~
> 
> The user should know when to use quotes when calling any of the exec
> functions.

Two sets of quotes are needed. Like this:

$result = `""c:\\program files\\some program\\prog.exe" "filename""`;

This won't work:

$result = `"c:\\program files\\some program\\prog.exe" "filename"`;

You think the user is meant to know that? I'm not suggesting magically adding quotes around
filenames which contain special characters, that's the user's responsibility. I'm suggesting adding
quotes around the entire command, with a /s switch preceding, so that the command specified by the
user is successfully passed to the command interpreter. This kind of quoting is done on Unix, see
tsrm_virtual_cwd.c around line 1016. But it is missing on Windows. It's a bug, plain and simple.

-- Tim Starling