Problem with files consists of spaces and single quotes?

Question

I'using the following code to create thumbnails using ffmpeg but it was working fine for the files which have no spaces or any quotes..

But when the file has a space (like 'sachin knock.flv') or files which have quotes (like sachin's_double_cent.mp4) it doesn't work..

What can i do to get those files work accurately? One restriction is that i can't rename files as they are lump some..

My code is

<?php
    error_reporting(E_ALL);
    extension_loaded('ffmpeg') or die('Error in loading ffmpeg');
    $link = mysql_connect('localhost', 'root', '');
    if (!$link) {
        die('Not connected : ' . mysql_error());
    }
    $db_selected = mysql_select_db('db', $link);

    $max_width  = 120;
    $max_height = 72;
    $path ="/home/rootuser/public_html/temp/";
    $qry="select id, input_file, output_file from videos where thumbnail='' or thumbnail is null;";
    $res=mysql_query($qry);
    while($row = mysql_fetch_array($res,MYSQL_ASSOC))
    {
        $orig_str = array(" ");
        $rep_str  = array("\ ");
        $outfile  = $row[output_file];
//      $infile   = $row[input_file];
        $infile1  = str_replace($orig_str, $rep_str, $outfile);

        $tmp      = explode(".",$infile1);
        $tmp_name = $tmp[0];
        $imgname  = $tmp_name.".png";
        $srcfile  = "/home/rootuser/public_html/uploaded_vids/".$outfile;
            echo exec("ffmpeg -i ".$srcfile." -r 1 -ss 00:00:05 -f image2 -s 120x72 ".$path.$imgname);
        $nname = "./temp/".$imgname;
        $fileo = fopen($nname,"rb");
        if($fileo)
        {
        $imgData = addslashes(file_get_contents($nname));
        echo $imgdata;
        $qryy="update videos set thumbnail='{$imgData}' where input_file='$outfile'"; 
        $ress=mysql_query($qryy);
        }
        else
            echo "Could not open<br><br>";
        unlink('$nname');    
    }
?>

Answer 1

Note that if the files are supplied by users, your code not only doesn't work, but is wide open to code injection.

This can be solved by using escapeshellcmd().