Vulnerable to arbitrary command execution

[cdown]

Hi,

Just to let you know, your use of system() is vulnerable to arbitrary command execution (this situation is especially bad since it can be invoked by anyone over IRC). Filtering characters is not enough. Don't use system(), use a real subprocess spawner that doesn't involve using a shell.

[cdown]

Specifically, because you do not properly sanitise all your variables, only $data, and the rest still have arbitrary input.

[jashmenn]

This is a very good point - I don't really use this any more, but people should be aware of it if they do.