I'm sure every shell has different quirks. Not to mention new versions of the shell come out, which could cause problems if you want the output of the format string to remain comparable with old data.
The worst problem of course is you end up with things like PHP's real_mysql_escape_string($str), which i would hate to have condensed into sprintf(buff, "%rmes", str). Let alone different versions for ksh/zsh/{insert thirty years of UNIX history here}.
You don't need to parse every little piece of syntactic sugar that is introduced by various shells. You're trying to produce something that will be parsed as a string literal. For the most part, non-alpha-numeric characters should just be escaped. If all non-[:alphanum:] characters were escaped regardless of need, I can't think of anything that would accidentally parse as anything dynamic in any of the shells out there.
Also, the most common case would be system(sprintf(...)). This should just pass the command onto the shell in compatibility mode, meaning most of the extra sugar should be disabled. Even all of zsh's string parsing sugar needs to be turned on (disabled by default).
Ignoring all of that, the most common thing that you want properly escaped would be:
- Semi-colon to prevent injection.
- Spaces to make sure that the string is parsed as a single arg.
- Quotes and double-quotes because you want them to be part of the argument text and not part of the shell's syntax.
Even that short list of requirements would be useful.
I'm sure every shell has different quirks. Not to mention new versions of the shell come out, which could cause problems if you want the output of the format string to remain comparable with old data.
The worst problem of course is you end up with things like PHP's real_mysql_escape_string($str), which i would hate to have condensed into sprintf(buff, "%rmes", str). Let alone different versions for ksh/zsh/{insert thirty years of UNIX history here}.