escape string for command line

Ksenia Marasanova ksenia.marasanova at
Fri Jan 7 14:59:33 EST 2005


I have a simple ecard creation script on a website, where user can add
text to a graphic. I use ImageMagick for it:

# template_file => path to image template file
# new_file => path to generated file
# text => user input
command = '''convert %s -font OfficinaSanITC-BookOS -pointsize 12
-fill "#8C2F48" -draw "gravity north text 0,26 '%s'" %s''' % (
    template_file, text, new_file)

I was wondering, is there a general way to escape the string entered
by the user, to prevent code injection into command line? Will it
always be safe, even when binary data is submitted through POST?
Or maybe some stable Python interface for ImageMagick that takes care of it :)

Thanks in advance,

More information about the Python-list mailing list