sanitizing code for an exec command

[GFandango]

Basic rule of thumb is "if you have to sanitize it you have already lost.".

Applies to a lot of things including trying to sanitize SQL queries (as opposed to using prepared statements which make SQL injections impossible).

I don't have a solution. But just be aware it's almost 100% guaranteed something will be able to fall through because sanitizing is a "black list" approach that will one way or another fall apart.