diff --git a/reference/exec/functions/proc-open.xml b/reference/exec/functions/proc-open.xml index 9ed1d95cbfa8..bd4de374cb1f 100644 --- a/reference/exec/functions/proc-open.xml +++ b/reference/exec/functions/proc-open.xml @@ -55,13 +55,14 @@ On Windows, unless bypass_shell is set to &true; in options, the command is passed to cmd.exe (actually, %ComSpec%) - with the /c flag as unquoted string - (i.e. exactly as has been given to proc_open). - This can cause cmd.exe to remove enclosing quotes from - command (for details see the cmd.exe documentation), - resulting in unexpected, and potentially even dangerous behavior, because - cmd.exe error messages may contain (parts of) the passed - command (see example below). + with the /s /c flags as + %ComSpec% /s /c "$command", which has the same + effect as executing command directly (without + additional quotes). + Prior to PHP 8.0.0, the /c flag was used without + /s, which could cause cmd.exe to + remove enclosing quotes from command + (see example below). @@ -216,6 +217,16 @@ non-empty element. + + 8.0.0 + + On Windows, the string command is now + executed via %ComSpec% /s /c "$command" instead + of the previous %ComSpec% /c $command, which + has the same effect as executing command + directly. + + 7.4.4