Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:30483
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain CoreTrek.no from 80.239.119.81 cause and error)
Date: Fri, 6 Jul 2007 08:42:19 +0200
To: Tzachi Tager <tzachi@zend.com>
Cc: internals@lists.php.net
Message-ID: <20070706064219.GA4515@fearless.intra.coretrek.com>
References: <06B0D32C7A96544490D18AF653D6BDE501075DCE@il-ex1.zend.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <06B0D32C7A96544490D18AF653D6BDE501075DCE@il-ex1.zend.net>
User-Agent: Mutt/1.5.16 (2007-06-11)
Subject: Re: [PHP-DEV] Suggestion for fixing Bug #40928
From: frode@CoreTrek.no ("Frode E. Moe")

On Fri, Jul 06, 2007 at 01:29:31 +0300, Tzachi Tager wrote:
> Hi,
> I was looking at Bug #40928 - escapeshellarg() does not quote percent
> (%) correctly for cmd.exe.
> This bug seems to be because escapeshellarg() in  Windows replaces '%'
> and '"' with spaces, while assuming there isn't a real escaping method
> for command line in Windows. Therefore I'm guessing no one really use
> escapeshellarg() or escapeshellcmd() on Windows. And in order to change
> this  I suggest to use the command line escaping that does exists
> (although looking a bit ugly), as you can see for example here:
> http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs
> /en-us/ntcmds_shelloverview.mspx?mfr=true , quoting: "You can use most
> characters as variable values, including white space. If you use the
> special characters <, >, |, &, or ^, you must precede them with the
> escape character (^) or quotation marks." - So all special characters
> will be replaced with "^<char>".
> So this is the diff file that I suggest to use- it for sure fix the
> above bug and may improve windows escapeshellcmd():

Hi, I'm the guy who reported the bug originally.

When I read your post now, I just realized that maybe there should be a
different set of escaping functions for win32 ("escapewin32arg" or
"escapecmdarg"?), so that the behaviour of escapeshellarg() does not change 
across platforms. (What if you want to dynamically generate a downloadable 
unix shell script, for example.)

Your patch was a bit difficult to read (too little context and not in
unidiff format), so I'll leave the commenting for those more familiar 
with the C source.

Thanks for working on the problem, anyway!