PHPMailer::isShellSafe( string $string ): bool

1833    protected static function isShellSafe($string)1834    {1835        //It's not possible to use shell commands safely (which includes the mail() function) without escapeshellarg,1836        //but some hosting providers disable it, creating a security problem that we don't want to have to deal with,1837        //so we don't.1838        if (!function_exists('escapeshellarg') || !function_exists('escapeshellcmd')) {1839            return false;1840        }1841 1842        if (1843            escapeshellcmd($string) !== $string1844            || !in_array(escapeshellarg($string), ["'$string'", "\"$string\""])1845        ) {1846            return false;1847        }1848 1849        $length = strlen($string);1850 1851        for ($i = 0; $i < $length; ++$i) {1852            $c = $string[$i];1853 1854            //All other characters have a special meaning in at least one common shell, including = and +.1855            //Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.1856            //Note that this does permit non-Latin alphanumeric characters based on the current locale.1857            if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {1858                return false;1859            }1860        }1861 1862        return true;1863    }