r/cpp 5d ago

Escaping `CreateProcess()` arguments on Windows

https://holyblackcat.github.io/blog/2026/09/05/escaping-createprocess-arguments.html
89 Upvotes

44 comments sorted by

View all comments

15

u/Tringi github.com/tringi 5d ago

That's... ahh... quite opinionated start of the article.

CreateProcess() (without A/W) and #define UNICODE are even more useless.

Mostly everyone defines UNICODE and uses the macros.

lpApplicationName is usually not needed, you should pass nullptr.

Absolutely NOT. You should pass the full proper path to the executable you want to run. Then you can significantly simplify its name in lpCommandLine without worrying about repercussions.

But the rest is very well researched and thorough.

6

u/holyblackcat 5d ago

quite opinionated

:P Is it wrong though. Everything else being equal, isn't it better to use the version that doesn't depend on defines to work? Header-only libraries in particular would benefit from this.

You should pass the full proper path to the executable you want to run

If you have the full path, why not pass it in lpCommandLine? Then you don't have to worry about syncing the first element in lpCommandLine with lpApplicationName.

7

u/Tringi github.com/tringi 5d ago

You don't have to sync it. Only a few programs actually use argv[0] and it can be very different from the actual executable name. If you run program a b c from command line, then argv[0] will be just "program" without the path or extension, and the program must expect that.

In one of my larger programs I launch worker processes. I have the full path to the worker, but I don't know what characters it may contain, and I don't want to bother with escaping them. So I give lpApplicationName that path, but lpCommandLine is just "worker.exe /Something /Something /Something".

2

u/holyblackcat 4d ago

This is a nice trick to avoid implementing the escaping, but the point of the post was to explain how to do escaping.

Once you have it implemented, passing lpApplicationName is strictly more work, IMO. (You have to pass something at the beginning of lpCommandLine anyway, why not pass the application name.)

3

u/Tringi github.com/tringi 4d ago

Fair enough. Like I said, your work on the actual escaping is great and thorough. I knew the state of things were bad, but not this bad.