DrManhattan, I agree with the sentiments in your post. I'm just providing some careful feedback on the jargon.

"Calling exec in scalar context like this," is wrong for two reasons. One, the poster is not calling exec(), the poster is using the qx// operator which is identical to the backtick operator. Two, the calling context refers to how the results are to be collected, not what arguments or operands are given, so this calling context is void.

As an aside, there's no reason to use backticks in void context; use system() or exec() instead. Backticks collect the output of a subprocess, and if you're in void context, you're collecting all that junk for nothing.

"Calling exec() in array context..." is also wrong for the definition of context. Phrasing it as "Calling exec() with a list..." is more proper. The documentation refers to this as the exec LIST form of the function, as opposed to the exec EXPR form.

Hope this helps clarify an otherwise good point on taint-validation and its security risk when not considered.

--
[ e d @ h a l l e y . c c ]