nicfit / eyeD3

eyeD3 is a Python module and command line program for processing ID3 tags. Information about mp3 files (i.e bit rate, sample frequency, play time, etc.) is also provided. The formats supported are ID3v1 (1.0/1.1) and ID3v2 (2.3/2.4).
http://eyed3.nicfit.net/
GNU General Public License v3.0
541 stars 58 forks source link

Song titles with ' in them fail with Php exec #567

Closed BlastFM closed 2 years ago

BlastFM commented 2 years ago

I'm using an exec in Php to call the eyeD3 editor with parameters

exec("eyeD3 --title='".$trackTitle."' ".$filename."");

This seems to work fine until I try to intert a title that has ' in it, "Can't Get Enough Of Your Love" for example

I have tried using addslashes and escapeshellarg functions to make it work but with no success. I know that it is probably an escaping issue somewhere but I can't find where and I can't seem to find any errors relating to eyeD3 in the system logs, does anyone know the answer?

BlastFM commented 2 years ago

I have made some progress on this. I used a command line instruction to run a test file and found that I was getting a sh: 1: Syntax error: Unterminated quoted string error when trying to add an artist name with a ' in it.

A very basic replacement was performed on the Artist/Title strings to escape spaces and double escape ' and I got it to work but this is a very basic example of things that might break and there are probably lots of cases where things need to be escaped in the future.

I also made the command syntax simpler and easier to read. $find = array("/\ /", "/'/"); $replace = array("\ ", "\\'"); $trackTitle = preg_replace($find, $replace, $trackTitle); $artistName = preg_replace($find, $replace, $artistName); exec("eyeD3 --artist={$artistName} {$filename}"); exec("eyeD3 --title={$trackTitle} {$filename}"); If anyone would like to add to the list of $find/$replace variables please feel free to do so.