Others have told you how to exploit this. In the spirit of advocating the right way to do things, here is a good way to execute
echo with user input and not have vulnerabilities (barring of course some bug in echo :-)):
execlp("echo", string_from_user, NULL);
If you deal directly with the
exec family of syscalls, you can pass unadulterated strings directly to the program without any chance that the shell will misinterpret them, because there is no shell in that case. Hence there is no need to escape.
There are more potential security problems with code like this. Here are some that I can think of:
If an untrusted user can modify
/bin/echo, obviously that untrusted user can make this run arbitrary code.
If an untrusted user can modify the
PATH environment variable, my
execlp example above is vulnerable. One workaround is to not use the -
p variants of the
exec family of syscalls, because those will not check