alt Hacker NewsThey also have single quote, dollar and backtick... this is a lot worse than just whitespace. The problem with whitespace surface when the programmer made no effort to escape the string used as a file name. This adds a whole new vector of problems that happen when the programmer tried to escape the string, but it didn't work.
It was too long ago, so, I've forgotten the names, but I remember the saga with PHP escaping (and failing) SQL queries (some sort of sql_real_now_honest_real_escape_string() function or something like that).
It depends on the shell you use and how your file names are handled.
Bash is a clusterfuck waiting to happen when it comes to file names, but not all shells would be at risk here. For example the shell I maintain would be fine because file names are tokenised like how variables are tokenised in SQL strings when using parametrised queries (to use your SQL/PHP example).