What is the particular command you're running?

Thanks.

I'm using this code (simplified from what I actually need, but shows the principle):

<?php
$arg = escapeshellarg('echo "hello";');
echo `php -r $arg`;

I wanted it to print hello, instead it says that hello is not a defined constant because it strips the double quotes.

Yeah, that were pretty valid with bash. For cmd.exe you'd do like

<?php
$arg = escapeshellarg('echo \'hello\';');
echo `php -r $arg`;

or i do it with

$arg = escapeshellarg("echo 'hello';");
system(PHP_BINARY . " -r $arg");

The behavior is though correct - on Windows escaping seems to be not the shell task, but the one of a program you're working with. Some programs can "eat" it with "" (escape with another double quote) or ^". The common thing is however to have an argument enclosed with double quotes or even without them. So a normal inline code is like

php.exe -r "echo 'hello';"

on Linux you would replace double quotes with single quotes and vice versa, as double quotes could be possible extrapolated with a Linux shell like bash/dash/etc.

Thanks.

If escaping is supposed to be the program's task, not the shell's task, then the quotation marks should be passed to the program, not replaced by spaces by escapeshellarg. Currently, escapeshellarg, on Windows, replaces double quotes with spaces, then encloses the entire argument with double quotes which is not something every program wants, nor is it documented.

Can I at least amend the documentation so it clarifies what the function does on Windows?

But this is the exact point - it is only known for sure that "arg" is fine, except we maintain the escaping info for every arbitrary program. It's more about the platform knowledge, but adding a note to the docs about this might make sense.

Thanks

This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.

JFTR: the job of escapeshellarg() is to escape a *single* *argument* (e.g. hello). To escape a full command (e.g. echo hello) use escapeshellcmd().