protected static function isShellSafe($string)
    {
        // Future-proof
        if (escapeshellcmd($string) !== $string
            or !in_array(escapeshellarg($string), ["'$string'", "\"$string\""])
        ) {
            return false;
        }

        $length = strlen($string);

        for ($i = 0; $i < $length; ++$i) {
            $c = $string[$i];

            // All other characters have a special meaning in at least one common shell, including = and +.
            // Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.
            // Note that this does permit non-Latin alphanumeric characters based on the current locale.
            if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {
                return false;
            }
        }

        return true;
    }
protected static function isShellSafe($string)
    {
        // Future-proof
        if (escapeshellcmd($string) !== $string
            or !in_array(escapeshellarg($string), ["'$string'", "\"$string\""])
        ) {
            return false;
        }

        $length = strlen($string);

        for ($i = 0; $i < $length; ++$i) {
            $c = $string[$i];

            // All other characters have a special meaning in at least one common shell, including = and +.
            // Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.
            // Note that this does permit non-Latin alphanumeric characters based on the current locale.
            if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {
                return false;
            }
        }

        return true;
    }
protected static function isShellSafe ( $ string ) { // Future-proof if ( escapeshellcmd ( $ string ) !== $ string or ! in_array ( escapeshellarg ( $ string ) , [ "'$string'" , "\"$string\"" ] ) ) { return false ; } $ length = strlen ( $ string ) ; for ( $ i = 0 ; $ i < $ length ; ++ $ i ) { $ c = $ string [ $ i ] ; // All other characters have a special meaning in at least one common shell, including = and +. // Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here. // Note that this does permit non-Latin alphanumeric characters based on the current locale. if ( ! ctype_alnum ( $ c ) && strpos ( '@_-.' , $ c ) === false ) { return false ; } } return true ; }
Fix CVE-2016-10033 and CVE-2016-10045 by disallowing potentially unsafe shell characters.
Note that escapeshellarg and escapeshellcmd are inadequate for our purposes, especially on Windows.

@see https://github.com/PHPMailer/PHPMailer/issues/924 CVE-2016-10045 bug report

@param string $string The string to be validated

@return bool
Fix CVE - 2016 - 10033 and CVE - 2016 - 10045 by disallowing potentially unsafe shell characters . Note that escapeshellarg and escapeshellcmd are inadequate for our purposes especially on Windows .