"callable via text"? What does that even mean? The command line is an API, isn't it? If people don't manage to pass an ampersand to another program via the command line, that's really no different than people failing to pass an ampersand as a URI parameter to an HTTP resource: Failure to encode properly. There is absolutely nothing that prevents you from passing an ampersand (or any other characters) to a program via its command line.

> "callable via text"? What does that even mean?

It means you have to execute commands through a shell. A real API would be something you could include in your program, execute a method against and get a list of objects back. Instead all these basic command are replicated in every framework.

As far as encoding properly, you're preaching to the choir, but out in the real world there is still injection attacks everywhere.

> It means you have to execute commands through a shell.

Except you don't. There is no need to involve a shell.

> A real API would be something you could include in your program, execute a method against and get a list of objects back.

So, Web APIs are not APIs?

Also, you can execute methods against command line programs, method names usually start with a dash.

Word-splitting, escape character interpretation and so forth is done by the shell. The shell is only invoked if you use the system() call to run said tool.

Which you shouldn't. execve (and friends) will let you pass an explicit array of flags, and you should always use one of those functions if you're calling another program. No interpretation.

On a Unix system, a console application is effectively just a vararg function taking a bunch of const char* arguments. There's no limitation on what characters you can pass as those arguments, so that doesn't sound like a valid excuse.

(There are some characters that are treated specially by shells, and require escaping - but you don't normally spawn child processes via a shell.)

But even PHP has a way to escape shell arguments safely

Having a way and being used everywhere are different things. That's why we still have sql injection attacks.