I made a small patch by disabling the characters " " (space), "&", and "|".
This can easily be bypassed. Example:
Other relevant characters include - but are not limited to - $, ```, etc.
As mentioned in the comments, you should use escapeshellarg instead (input filtering is quite ...
I must admit I hadn't heard of the youtube-dl program but it seems quite nifty. Perhaps it was what many of the websites I have seen for downloading YT videos use behind the scenes.
I tried using the script locally and found that the URL must contain an ampersand (i.e. have 2+ query string variables), otherwise the logic to look for a ...