command injection through php shell escape functions