title: escapeshellcmd warning
body: <p>In the php documentation pages for <code>escapeshellcmd</code> there is a warning:</p>
  
  <blockquote>
    <p><strong>escapeshellcmd() should be used on the whole command string</strong>, and it
    still allows the attacker to pass arbitrary number of arguments. For
    escaping <strong>a single argument</strong> escapeshellarg() should be used instead.</p>
  </blockquote>
  
  <p>What am I to understand from this:</p>
  
  <ol>
  <li>Should I always escape the whole command string using escapeshellcmd, including arguments that have already been escaped with escpaeshellarg?</li>
  <li>Should I only escape command items that are not parameters (The only logical thing to do if you ask me)?</li>
  <li>Should I just ignore this dubious warning that creates even more confusion about how these 2 functions compliment each other?</li>
  </ol>
  
  <p>Thank you,
  Cosmin</p>