prevent shell special chars injection in Sys.command arguments

std/cpp/_std/Sys.hx

@@ -85,14 +85,14 @@
 		var ok = true;
 		for( i in 0...arg.length )
 			switch( arg.charCodeAt(i) ) {
-			case 32, 34: // [space] "
+			case ' '.code, '\t'.code, '"'.code, '&'.code, '|'.code, '<'.code, '>'.code, '#'.code , ';'.code, '*'.code, '?'.code, '('.code, ')'.code, '{'.code, '}'.code, '$'.code:
 				ok = false;
 			case 0, 13, 10: // [eof] [cr] [lf]
 				arg = arg.substr(0,i);
 			}
 		if( ok )
 			return arg;
-		return '"'+arg.split('"').join('\\"')+'"';
+		return '"'+arg.split('\\').join("\\\\").split('"').join('\\"')+'"';
 	}
 
 	public static function command( cmd : String, ?args : Array<String> ) : Int {

std/neko/_std/Sys.hx

@@ -95,14 +95,14 @@
 		var ok = true;
 		for( i in 0...arg.length )
 			switch( arg.charCodeAt(i) ) {
-			case 32, 34: // [space] "
+			case ' '.code, '\t'.code, '"'.code, '&'.code, '|'.code, '<'.code, '>'.code, '#'.code , ';'.code, '*'.code, '?'.code, '('.code, ')'.code, '{'.code, '}'.code, '$'.code:
 				ok = false;
 			case 0, 13, 10: // [eof] [cr] [lf]
 				arg = arg.substr(0,i);
 			}
 		if( ok )
 			return arg;
-		return '"'+arg.split('"').join('\\"')+'"';
+		return '"'+arg.split('\\').join("\\\\").split('"').join('\\"')+'"';
 	}
 
 	public static function command( cmd : String, ?args : Array<String> ) : Int {

std/php/_std/Sys.hx

@@ -73,14 +73,14 @@
 		var ok = true;
 		for( i in 0...arg.length )
 			switch( arg.charCodeAt(i) ) {
-			case 32, 34: // [space] "
+			case ' '.code, '\t'.code, '"'.code, '&'.code, '|'.code, '<'.code, '>'.code, '#'.code , ';'.code, '*'.code, '?'.code, '('.code, ')'.code, '{'.code, '}'.code, '$'.code:
 				ok = false;
 			case 0, 13, 10: // [eof] [cr] [lf]
 				arg = arg.substr(0,i);
 			}
 		if( ok )
 			return arg;
-		return '"'+arg.split('"').join('\\"')+'"';
+		return '"'+arg.split('\\').join("\\\\").split('"').join('\\"')+'"';
 	}
 
 	public static function command( cmd : String, ?args : Array<String> ) : Int {