Description:
------------
This bug was reported some months ago about odd escaping in 
popen() when safe_mode is on:
http://bugs.php.net/bug.php?id=32701

Arguments correctly escaped, as with escapeshellarg(), end 
up being unexpectedly corrupted under safe_mode with the 
addition of unexpected backslashes.

The bug was marked as BOGUS. If it this is the intended 
behavior, the documentation needs to be modified to reflect 
this. Currently the docs for popen() and several other 
functions include only this caveat:

"With safe mode enabled, all words following the initial 
command string are treated as a single argument. Thus, echo 
y | echo x becomes echo "y | echo x"."

However that is *false*:
1) Multiple arguments are sent where separated by spaces.
2) Quotes seem to be understood, so multi-word arguments are 
themselves passed intact.
3) In addition to this sensible behavior, many characters 
have backslashes inserted before them, even if they are 
inside already-quoted arguments.

Accurate documentation, and an explanation of how to get 
parameters to the other program without corruption, would be  
a huge help in making our programs work correctly under 
safe_mode.

cf http://bugzilla.wikimedia.org/show_bug.cgi?id=3891#c13


Reproduce code:
---------------
<?php
$r = popen("echo '-=< Test >=-'", "r");
print(stream_get_contents($r));
pclose($r);
?>

Expected result:
----------------
-=< Test >=-


Actual result:
--------------
-=\< Test \>=-