Am 03.08.2011 19:27 schrieb Chris Rebert:
shell= True,
I would strongly encourage you to avoid shell=True.
ACK, but not because it is hard, but because it is unnecessary and
unelegant at this point.
You really don't want to have to worry about doing proper shell escaping
yourself.
That's nothing to really worry about - just doing
def shellquote(*strs):
return " ".join([
"'"+st.replace("'","'\\''")+"'"
for st in strs
])
would do perfectly: shellquote('echo', "'", '"', " ", "\n")
If you emit a command line over ssh, for example, you don't have another
simple choice.
There are only worries if there is a shell which better shouldn't be
named like this. As you generally cannot know what ugly things the user
of your program does, it is better to avoid the additional shell layer.
So generally agree to what you say, but it is not the proper shell
escaping one should worry about (it is so simple that one cannot call it
"worry"), but the type of shell one talks with.
Thomas
--
http://mail.python.org/mailman/listinfo/python-list
