Description:
------------
When delayed variable substitution is enabled (can be set in the
Registry, for instance), !ENV! works similar to %ENV%, and the
value of the environment variable ENV will be subsituted.

Neither escapeshellcmd() nor escapeshellarg() handle ! as a
special character, so this can cause security issues.

I suggest to treat ! the same as %, i.e. escape it with ^ in
escapeshellcmd() and replace it with a space in escapeshellarg(),
like it's done in the attached patch.