<?phpfunction EscapeShellArg($x) { return "'".ereg_replace("'", "\'", $x)."'"; }?>
exec('/home/user/myprogram '.EscapeShellArg($user_input));