escapeshellarg()

escapeshellarg() — Escape a string to be used as a shell argument.

Built-in function of PHP 8.5. The manual lists it as available in PHP 4 >= 4.0.3, PHP 5, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument. This function should be used to escape individual arguments to shell functions coming from user input. The shell functions include exec(), system() and the backtick operator.

Signature

escapeshellarg(string $arg): string

Parameters

Return value

The escaped string.

Example

A runnable snippet:

system('ls '.escapeshellarg($dir));

See also

setlocale(), escapeshellcmd(), exec(), popen(), system()

All PHP 8.5 built-in functions

Reference card built from the PHP manual page escapeshellarg() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.