Say you have to shell out to a command and part of it comes from user input. How do you do that without handing someone command injection?

So the danger is user input ending up inside a shell command. Like exec runs the whole command string through a shell, so if you build it with user input, something like exec(`convert ${filename}`), then a filename with shell metacharacters in it can run arbitrary commands. The safer way is spawn or execFile, where you pass the command and its arguments separately as an array, and then the input just gets treated as one argument instead of shell syntax. I'd also validate any user input, and I try not to build command strings by concatenation at all. If there's a native library that does the same job I'd probably just use that and skip the shell entirely. And run the process with least privilege, so even if something goes wrong the damage stays limited. Basically never trust user input in a command line.