This requires that you pass raw user input on the command line to CreateProcess and the executable resolved to a batch file. That should be relatively rare. Still it's annoying the way command line expansion works in Windows. You have to know whether the target of CreateProcess is a binary or script to decide whether you should escape the arguments or not. Running scripts like this on Unix systems is also a potential source of problems.but at least execve works relatively predictably.