# Tag Info

Security Command injection I made a small patch by disabling the characters " " (space), "&", and "|". This can easily be bypassed. Example: url=http://example.com/;id;?%26x=y; Other relevant characters include - but are not limited to - \$, `, etc. As mentioned in the comments, you should use escapeshellarg instead (input filtering is quite ...