It depends on the shell you use and how your file names are handled.

Bash is a clusterfuck waiting to happen when it comes to file names, but not all shells would be at risk here. For example the shell I maintain would be fine because file names are tokenised like how variables are tokenised in SQL strings when using parametrised queries (to use your SQL/PHP example).