String::ShellQuote
, but most of the time this is not needed. You simply can avoid invoking the shell by careful programming. For example, system
takes a list of arguments instead of a string.
Best practice:
use IPC::System::Simple qw(systemx);
systemx($command, @arguments);
require IPC::System::Simple;
use autodie qw(:all);
system([@allowed_exit_values], $command, @arguments);