Question

Php has a method escapeshellcmd() that escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands.

<?php
exec(find /music -type f -iname '*mp3'", $arrSongPaths);
echo $arrSongPaths[0] //prints It Won´t Be Long.mp3;
echo escapeshellcmd($arrSongPaths[0]) //prints It Wont Be Long.mp3;
?>

Is there a way to write a shell script that will recursively rename filenames (in particular *mp3) with special characters escaped?

I tried to do this in php

$escapedSongPath = escapeshellarg($arrSongPaths[0]);    
exec("mv $arrSongPaths[0] $escapedSongPath");

but that didn’t work. Anyways the last line of code is unsafe since you’re executing a command with a potentially dangerous filename $arrSongPaths[0].

Answer 1

For the love of all things security related why aren’t you using the php rename command – it doesn’t suffer from any shell escape issues. replace the exec("mv ...") with:

rename($arrSongPaths[0], $escapedSongPath)

… and check for errors.

And instead of using exec(find...) use the recursive_glob tip from the glob php operation page.