I have the following script:

$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");

Is there a way to properly escape the user_input?


1 Answer 1


The function escapeshellarg safely quotes a value (including escaping quotes in the name, etc) so that it can be used as an argument in a command string passed to a shell.

$user_input = $_POST['user_input'];
shell_exec('php some_file.php '.escapeshellarg($user_input));

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .