Use escapeshellarg to prevent code execution

Without escapeshellarg someone could use ``$pin = '; sudo rm -rf /';`` or something similar.
You can try this by running the following script:

    <?php
      $foo = "foo; whoami";
      echo shell_exec("echo $foo");
      $bar = escapeshellarg($foo);
      echo shell_exec("echo $bar");
    ?>