The EscapeShellCmd is not useful. What are you supposed to do with it? It's pointless.

You should instead have a new function, EscapeShellArg, which does the following:

function EscapeShellArg($cmd) {
  return "'".ereg_replace("'", "'\\''", $cmd)."'";
}

this way you actually *can* run shell processes safely, e.g.:

exec('/bin/foo arg1 arg2 '.EscapeShellArg($cgivar));