Use `escapeshellarg()` on the query string passed to `shell_exec()`, to make sure its treated safely as a single argument.
Update web/show.php
Merge pull request #1 from shesek/patch-1

Use escapeshellarg() on the query string passed to shell_exec()