title: Safe executing shell scripts; escaping vars before execution
body: <p>Let's imagine that we have a simple php script that should get <code>ssh_host</code>, <code>ssh_username</code>, <code>ssh_port</code> from $_GET array and try to connect using this parameters to SSH.</p>
  
  <pre><code>$port      = escapeshellcmd($_GET['ssh_port']);
  $host      = escapeshellcmd($_GET['ssh_host']);
  $username  = escapeshellcmd($_GET['ssh_username']);
  
  $answer = shell_exec("ssh -p " . $port . " " . $user . "@" . $host);
  </code></pre>
  
  <p>Is <code>escapeshellcmd()</code> enough or I need something more tricky?
  Or maybe I should use <code>escapeshellarg()</code> in this example?</p>
  
  <p>Thank you.</p>