Edit report at http://bugs.php.net/bug.php?id=54391&edit=1
ID: 54391 Updated by: fel...@php.net Reported by: c dot madmax at gmail dot com Summary: escapeshellarg strip non-ascii characters -Status: Open +Status: Bogus Type: Bug Package: Program Execution Operating System: All Debian and Ubuntu Versions PHP Version: 5.3.6 Block user comment: N Private report: N New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php Previous Comments: ------------------------------------------------------------------------ [2011-03-26 15:18:43] fel...@php.net See bug #44945 ------------------------------------------------------------------------ [2011-03-26 15:12:53] c dot madmax at gmail dot com Description: ------------ escapeshellarg() strip non-ascii characters if the LANG environment variable is not set to somthing like LANG=*.ISO-8959-1 e.g. LANG=en_US.ISO-8959-1 The job of escapeshellarg() is only to escape characters and NOT to remove them!!! The manual say nothing about removing characters!!! Removing characters can cause horrible results!!! It should doesn't matter if a shell arg has a ISO-8959-1 charset or UTF-8 charset or any other charset, because it is possible that a filename has a ISO-8959-1 charset and a other filename has a UTF-8 charset!!! escapeshellarg() should only look for quotes and escape them, and nothing else!!! PS: setlocale(LC_ALL, 'en_US.ISO-8959-1') and/or putenv('LANG=en_US.ISO-8959-1') dosn't fix this problem! And i think even if this work it's not good a solution! Test script: --------------- <?php $path = escapeshellarg('/home/www-data/äöüÃÃÃÃ'); // ISO-8959-1 characters = "\xE4\xF6\xFC\xC4\xD6\xDC\xDF" in hex format shell_exec(sprintf('rm -fr %s', $path)); echo sprintf('%s removed', $path); ?> Expected result: ---------------- The test script should remove the folder /home/www-data/äöüÃÃÃà and output: '/home/www-data/äöüÃÃÃÃ' removed Actual result: -------------- The test script remove the folder /home/www-data/ and output '/home/www-data/' removed ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=54391&edit=1
