[docs] [issue30079] Explain why it is recommended to pass args as a string rather than as a sequence If shell is True

[Eryk Sun]

Eryk Sun added the comment:

In Unix, passing an args list with shell=True makes the first element the -c command. The remaining elements are arguments for the shell itself, which makes them $N variables. For example:

    >>> subprocess.call(['echo $0, $1', 'spam', 'eggs'], shell=True)
    spam, eggs

In Windows, subprocess.list2cmdline assumes VC++ rules for creating a command line from a list. cmd's parsing rules are very different -- e.g. '^' is the escape character, and double quotes also escape special characters, except not '%'. (Shockingly there is no way to escape '%' on the cmd.exe command line -- only in batch files by doubling it. If you think '^' escapes it, you're wrong. cmd looks for an environment variable containing the '^' character. By luck it's usually not found.) cmd's parsing is convoluted, to say the least. Now combine that with having to pass command lines for external programs in way that they survive cmd's parsing without also breaking how the external program parses its command line. This problem is intractable. Just use a string. For anything complicated you may have to experiment a few times to figure out some permutation that works. The best option is to not use the shell at all.

----------
nosy: +eryksun

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue30079>
_______________________________________