How Windows PHP executes programs

Most of the PHP program execution functions (exec shell_exec passthru etc) pass the command to be invoked through cmd.exe, which is the Windows command interpreter. The only case where this might not happen is when calling proc_open.

cmd.exe

PHP calls one of the CreateProcess functions, with the following lpCommandLine parameter:

cmd.exe /c "command"

The /c option tells cmd.exe to carry out the specified command and then terminate. Note that PHP encloses command in double-quotes, which ensures that its contents will be preserved. See How cmd.exe extracts a command.

proc_open

cmd.exe is used by default, as described above, except that it does not enclose command in double-quotes in versions below PHP 8. A program can be executed directly by setting the bypass_shell option to true.