escapeshellarg function depends on your current locale. I think it’s bad, but PHP developers made this choice. If like me your default locale is ‘C’ you lose all UTF8 characters.
They suggest you to call something like
setlocale(LC_CTYPE, "en_US.UTF-8"). It doesn’t work if the
en_US.utf8 locale is not installed on your system. Of course maybe you have the
de_DE.utf8, but you will have to try all of them until you find one utf8 matching locale. And if there is not, you’re screwed. It’s also bad if you want code that runs everywhere.
Simply use that:
$escapedArg = "'".str_replace("'", "'\\''", $arg)."'";
It will do the same as the
escapeshellarg function: replace
as described in the escapeshellarg manual (and I also looked into the PHP source code to be sure).