escapeshellcmd on Windows

Thanks for the tip, I can’t remove that because it that prevents a security hole for Linux.

OK, here is the reason:

If the path looks like this (with spaces):

C:/Program Files/MySQL/MySQL Server 5.6/bin/mysqldump.exe

then $backup['mysqldumppath'] already has double quotes around it

"C:/Program Files/MySQL/MySQL Server 5.6/bin/mysqldump.exe"

You add $brace without checking that the quotes already there, so it becomes

""C:/Program Files/MySQL/MySQL Server 5.6/bin/mysqldump.exe""

and then, after the escapeshellcmd, it looks like:

"^"C:/Program Files/MySQL/MySQL Server 5.6/bin/mysqldump.exe^""

So, I guess, the fix could lie in checking for double-bracing.

Hmm your $backup['mysqldumppath'] has double quotes itself in the settings page?

Here is the field content:

a:16:{s:13:"mysqldumppath";s:57:"C:/Program Files/MySQL/MySQL Server 5.6/bin/mysqldump.exe";s:9:"mysqlpath";s:53:"C:/Program Files/MySQL/MySQL Server 5.6/bin/mysql.exe";
...

OK, I believe what I wrote before was confusing. Forget it.

All is very simple:

escapeshellcmd(‘”notepad”‘)

returns “^”notepad^””

(Windows 8.1, PHP 5.5)

So, the real question is why need to $brace ?

I agree!

If you replace https://github.com/lesterchan/wp-dbmanager/blob/master/database-backup.php#L27 with $brace = ”, does it work?

I need to be sure first before I remove it since I don’t have access to a windows computer

No Lester, braces are needed because of the spaces in the “Program Files”… path. Not sure, by the way, why you do not need them in UNIX.
You can create mkdir "a b c" folder.
Then try
php -r “echo escapeshellcmd(‘a b c/mysql’);”
– it will keep the spaces.

So, I believe, the $brace is OK, but not before escaping. After. This way:

$backup['command'] = $brace . escapeshellcmd( $backup['mysqldumppath'] ) . $brace . ' --force --host=' . escapeshellarg( $backup['host'] ) . ' --user=' . escapeshellarg( DB_USER ) . ' --password=' . escapeshellarg( DB_PASSWORD ) . $backup['port'] . $backup['sock'] . $backup['charset'] . ' --add-drop-table --skip-lock-tables ' . DB_NAME . ' > ' . $brace . escapeshellcmd( $backup['filepath'] ) . $brace;

Got it, thanks for your patience and the explanation, I will fix it.

I fixed it for the next version, could you let me know if it works? https://github.com/lesterchan/wp-dbmanager/archive/master.zip

Works OK on my Win machine, Lester.

Did you try placing mysqldump binary into a folder with spaces on Linux?

Nope not yet =) but without spaces works fine, I will try with spaces.