escapeshellcmd()

escapeshellcmd() — Escape shell metacharacters.

Built-in function of PHP 8.5. The manual lists it as available in PHP 4, PHP 5, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

escapeshellcmd() escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands. This function should be used to make sure that any data coming from user input is escaped before this data is passed to the exec() or system() functions, or to the backtick operator.

Signature

escapeshellcmd(string $command): string

Parameters

Return value

The escaped string.

Example

A runnable snippet:

// We allow arbitrary number of arguments intentionally here. $command = './configure '.$_POST['configure_options']; $escaped_command = escapeshellcmd($command); system($escaped_command);

See also

setlocale(), escapeshellarg(), exec(), popen(), system()

All PHP 8.5 built-in functions

Reference card built from the PHP manual page escapeshellcmd() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.