title: How good is using %q in Lua to escape shell arguments?
body: <p>Let's say we need to pass some argument to a shell command. (Let's assume a Bourne compatible shell.)</p>
  
  <p>For example, let's say we want to print the string <code>He said "It's a boy"; sure</code> using echo(1).</p>
  
  <p>Naturally, we can't do it this way:</p>
  
  <pre class="lang-lua prettyprint-override"><code>s = [[He said "It's a boy"; sure]]
  os.execute("echo " .. s)
  </code></pre>
  
  <p>But the following works fine:</p>
  
  <pre class="lang-lua prettyprint-override"><code>s = [[He said "It's a boy"; sure]]
  os.execute(("echo %q"):format(s))
  </code></pre>
  
  <p>My question: Do you think using %q to quote shell arguments is good enough?</p>
  
  <p>I already know that <code>%q</code> isn't quite good if our argument includes a newline (it would get converted to slash+newline, which would mean that the shell would see no character; but at least it won't break the command). So that's one case against us. Are there any other cases where <code>%q</code> will fail us?</p>