So I'm watching the stream, and he just politely asked the viewers to "please stop hacking", then started working on a regex to filter non-alpha numeric characters.
Was it seriously just echo-ing the raw input to a shell? Wow. Just wow.
There was always addslashes there, but I decided to filter out everything else too since I didn't quite know what kind of shell features there are. I know this is not the proper way to pipe input to the say command, but best coding practices weren't exactly on my mind when doing a thing in 5 minutes I didn't know if anyone would even check out =)
Was it seriously just echo-ing the raw input to a shell? Wow. Just wow.