title: C++: How to escape user input for safe system calls?
body: <p>On a Linux platform, I have C++ code that goes like this:</p>
  
  <pre><code>// ...
  std::string myDir;
  myDir = argv[1]; // myDir is initialized using user input from the command line.
  std::string command;
  command = "mkdir " + myDir;
  if (system(command.c_str()) != 0) {
     return 1;
  }
  // continue....
  </code></pre>
  
  <ul>
  <li>Is passing user input to a system() call safe at all? </li>
  <li>Should the user input be escaped / sanitized?</li>
  <li>How?</li>
  <li>How could the above code be exploited for malicious purposes?</li>
  </ul>
  
  <p>Thanks.</p>