I'm trying to create a basic function that will pass a filename and arguments to a program using call() from the subprocess module. The filename and arguments are variables. When I use call() it takes the variables but the called program reads their strings with " included.
Here's the code in question:
from subprocess import call
def mednafen():
print "Loading "+romname+"..."
call(["mednafen", args, romname])
print "Mednafen closed."
romname="kirby.zip"
args="-fs 1"
mednafen()
I expected this would execute
mednafen -fs 1 kirby.zip
but instead it appears to interpret the variable's strings as this:
mednafen "-fs 1" "kirby.zip"
Because of this, mednafen isn't able to run because it can't parse an argument that starts with ".
It works as expected if I use shell=True but that feature is apparently strongly discouraged because it's easy to exploit?
call("mednafen "+ args +" "+romname+"; exit", shell=True)
Is there a way to do this without using the shell=True format?
exitwhen calling a shell; it will exit when it has completed your commands (and it's hard to imagine what would happen if this wasn't the case).&affecting the shell.