Question: Is this considered safe?

```
def clipboard(foo):
import sys, subprocess
system = sys.platform

if 'win' in system:
    cmd = 'echo %s | CLIP' % (foo,)
    subprocess.call(cmd, shell=True)

if __name__ == '__main__':
    clipboard('RMDIR /S/Q C:\') #something terrible that actually works.

```

Nevermind that this is simply copying some input into the clipboard. I'm asking: by wrapping my arguments into a formatted string, referencing an element in a tuple, am I preventing the possibility of a shell injection attack?

Answer: 
No, shell injection still happens in your case for this:
clipboard('hello;RMDIR /S/Q C:\')
this will put 'hello' to your clipboard but execute the rmdir.

Possibly using quotation marks and shlex could help, as in:

```
import shlex
if 'win' in system:
    safe_arg='"%s"'%foo
    assert len(shlex.split(safe_arg)) == 1, "Injection attempt detected"
    cmd = 'echo %s | CLIP' % (safe_arg,)

```

EDIT: The code above was still neither safe nor robust. I think the following is at least better, but may still report false positives:

```
foo = str(foo.strip('"').strip())
safe_arg = '"%s"'%foo
if '"' in foo:
    if (len(shlex.split(safe_arg, False, False)) != 1): ...

```
As you can [read in the manual](http://docs.python.org/library/subprocess.html#frequently-used-arguments), executing commands in a shell is vulnerable to injection attacks if you use unsanitized text from an untrusted source as the command. This is only a problem if the program is running with more privileges than the user would normally have.

This is completely separate from the issue of immutable objects. Python strings are [immutable](http://docs.python.org/library/stdtypes.html#mutable-sequence-types).