Patch 7.3.446 (after 7.3.445)
Problem:    Win32: External commands with special characters don't work.
Solution:   Add the 'shellxescape' option.
Files:      src/misc2.c, src/option.c, src/option.h, runtime/doc/options.txt

*** ../vim-7.3.445/src/misc2.c  2012-02-19 18:19:24.000000000 +0100
--- src/misc2.c 2012-02-20 22:05:22.000000000 +0100
***************
*** 3225,3235 ****
            retval = mch_call_shell(cmd, opt);
        else
        {
!           ncmd = alloc((unsigned)(STRLEN(cmd) + STRLEN(p_sxq) * 2 + 1));
            if (ncmd != NULL)
            {
                STRCPY(ncmd, p_sxq);
!               STRCAT(ncmd, cmd);
                /* When 'shellxquote' is ( append ).
                 * When 'shellxquote' is "( append )". */
                STRCAT(ncmd, STRCMP(p_sxq, "(") == 0 ? (char_u *)")"
--- 3225,3243 ----
            retval = mch_call_shell(cmd, opt);
        else
        {
!           char_u *ecmd = cmd;
!
!           if (*p_sxe != NUL && STRCMP(p_sxq, "(") == 0)
!           {
!               ecmd = vim_strsave_escaped_ext(cmd, p_sxe, '^', FALSE);
!               if (ecmd == NULL)
!                   ecmd = cmd;
!           }
!           ncmd = alloc((unsigned)(STRLEN(ecmd) + STRLEN(p_sxq) * 2 + 1));
            if (ncmd != NULL)
            {
                STRCPY(ncmd, p_sxq);
!               STRCAT(ncmd, ecmd);
                /* When 'shellxquote' is ( append ).
                 * When 'shellxquote' is "( append )". */
                STRCAT(ncmd, STRCMP(p_sxq, "(") == 0 ? (char_u *)")"
***************
*** 3240,3245 ****
--- 3248,3255 ----
            }
            else
                retval = -1;
+           if (ecmd != cmd)
+               vim_free(ecmd);
        }
  #ifdef FEAT_GUI
        --hold_gui_events;
*** ../vim-7.3.445/src/option.c 2012-02-19 18:19:24.000000000 +0100
--- src/option.c        2012-02-20 22:01:07.000000000 +0100
***************
*** 2273,2278 ****
--- 2273,2287 ----
                            (char_u *)"",
  #endif
                                (char_u *)0L} SCRIPTID_INIT},
+     {"shellxescape", "sxe", P_STRING|P_VI_DEF|P_SECURE,
+                           (char_u *)&p_sxe, PV_NONE,
+                           {
+ #if defined(MSDOS) || defined(WIN16) || defined(WIN3264)
+                           (char_u *)"\"&|<>()@^",
+ #else
+                           (char_u *)"",
+ #endif
+                               (char_u *)0L} SCRIPTID_INIT},
      {"shiftround",  "sr",   P_BOOL|P_VI_DEF|P_VIM,
                            (char_u *)&p_sr, PV_NONE,
                            {(char_u *)FALSE, (char_u *)0L} SCRIPTID_INIT},
*** ../vim-7.3.445/src/option.h 2011-10-20 21:09:25.000000000 +0200
--- src/option.h        2012-02-20 21:45:31.000000000 +0100
***************
*** 712,717 ****
--- 712,718 ----
  #endif
  EXTERN char_u *p_shq;         /* 'shellquote' */
  EXTERN char_u *p_sxq;         /* 'shellxquote' */
+ EXTERN char_u *p_sxe;         /* 'shellxescape' */
  EXTERN char_u *p_srr;         /* 'shellredir' */
  #ifdef AMIGA
  EXTERN long   p_st;           /* 'shelltype' */
*** ../vim-7.3.445/runtime/doc/options.txt      2012-02-12 23:23:25.000000000 +0100
--- runtime/doc/options.txt     2012-02-20 22:09:19.000000000 +0100
***************
*** 6023,6030 ****

                                                *'shellxquote'* *'sxq'*
  'shellxquote' 'sxq'   string  (default: "";
!                                       for Win32, when 'shell' is cmd.exe or
!                                       contains "sh" somewhere: "\""
                                        for Unix, when using system(): "\"")
                        global
                        {not in Vi}
--- 6042,6050 ----

                                                *'shellxquote'* *'sxq'*
  'shellxquote' 'sxq'   string  (default: "";
!                                       for Win32, when 'shell' is cmd.exe: "("
!                                       for Win32, when 'shell' contains "sh"
!                                       somewhere: "\""
                                        for Unix, when using system(): "\"")
                        global
                        {not in Vi}
***************
*** 6032,6037 ****
--- 6052,6060 ----
        the "!" and ":!" commands.  Includes the redirection.  See
        'shellquote' to exclude the redirection.  It's probably not useful
        to set both options.
+       When the value is '(' then ')' is appended. When the value is '"('
+       then ')"' is appended.
+       When the value is '(' then also see 'shellxescape'.
        This is an empty string by default on most systems, but is known to be
        useful for on Win32 version, either for cmd.exe which automatically
        strips off the first and last quote on a command, or 3rd-party shells
***************
*** 6041,6046 ****
--- 6064,6079 ----
        This option cannot be set from a |modeline| or in the |sandbox|, for
        security reasons.

+                                               *'shellxescape'* *'sxe'*
+ 'shellxescape' 'sxe'  string  (default: "";
+                                for MS-DOS and MS-Windows: "\"&|<>()@^")
+                       global
+                       {not in Vi}
+       When 'shellxquote' is set to "(" then the characters listed in this
+       option will be escaped with a '^' character.  This makes it possible
+       to execute most external commands with cmd.exe.
+
+
                        *'shiftround'* *'sr'* *'noshiftround'* *'nosr'*
  'shiftround' 'sr'     boolean (default off)
                        global
*** ../vim-7.3.445/src/version.c        2012-02-19 18:19:24.000000000 +0100
--- src/version.c       2012-02-20 22:12:32.000000000 +0100
***************
*** 716,717 ****
--- 716,719 ----
  {   /* Add new patch number below this line */
+ /**/
+     446,
  /**/

--
hundred-and-one symptoms of being an internet addict:
86. E-mail Deficiency Depression (EDD) forces you to e-mail yourself.

 /// Bram Moolenaar -- B...@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///

vim7.3.446 is not working with 'noshelltemp' option in MS-Windows.

gvim.exe -u NONE
:set noshelltemp
:set noshellslash
:echo system('ls')

ls: cannot access >c:\cygwin-1.7\tmp\VIo475.tmp: No such file or directory
ls: cannot access 2>&1: No such file or directory
E484: Can't open file c:\cygwin-1.7\tmp\VIo475.tmp

:set shellslash
ls: cannot access >c:/cygwin-1.7/tmp/VIo476.tmp: No such file or directory
ls: cannot access 2>&1: No such file or directory
E484: Can't open file c:/cygwin-1.7/tmp/VIo476.tmp

vim7.3.442 and vim7.3.443 is working.

:set shelltemp
:!start explorer.exe
E371: Command not found.

vim7.3.442 default
shell=C:\WINDOWS\system32\cmd.exe
shellpipe=>
shellredir=>%s 2>&1
shellcmdflag=/c
shellquote=
shellxquote=

vim7.3.443 default
shell=cmd.exe
shellpipe=>
shellredir=>%s 2>&1
shellcmdflag=/s /c
shellquote=
shellxquote=\"

vim7.3.446 default
shell=C:\WINDOWS\system32\cmd.exe
shellpipe=>
shellredir=>%s 2>&1
shellcmdflag=/c
shellquote=
shellxquote=(
shellxescape="&|<>()@^

() is workaround for cmd.exe

It's not needed for ':!start'. ':!start' should call external program
directly.
https://raw.github.com/gist/1872497/gistfile1.diff

diff -r 068bb8a58a4e src/os_win32.c
--- a/src/os_win32.c    Mon Feb 20 22:18:30 2012 +0100
+++ b/src/os_win32.c    Tue Feb 21 09:16:28 2012 +0900
@@ -3898,121 +3898,102 @@
     else
     {
        /* we use "command" or "cmd" to start the shell; slow but easy */
-       char_u *newcmd;
-       long_u cmdlen =  (
+       char_u *cmdbase = cmd;
+
+       /* Skip a leading ", ( and "(. */
+       if (*cmdbase == '"' )
+           ++cmdbase;
+       if (*cmdbase == '(')
+           ++cmdbase;
+       if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
+       {
+           STARTUPINFO         si;
+           PROCESS_INFORMATION pi;
+           DWORD                       flags = CREATE_NEW_CONSOLE;
+
+           si.cb = sizeof(si);
+           si.lpReserved = NULL;
+           si.lpDesktop = NULL;
+           si.lpTitle = NULL;
+           si.dwFlags = 0;
+           si.cbReserved2 = 0;
+           si.lpReserved2 = NULL;
+
+           cmdbase = skipwhite(cmdbase + 5);
+           if ((STRNICMP(cmdbase, "/min", 4) == 0)
+                   && vim_iswhite(cmdbase[4]))
+           {
+               cmdbase = skipwhite(cmdbase + 4);
+               si.dwFlags = STARTF_USESHOWWINDOW;
+               si.wShowWindow = SW_SHOWMINNOACTIVE;
+           }
+           else if ((STRNICMP(cmdbase, "/b", 2) == 0)
+                   && vim_iswhite(cmdbase[2]))
+           {
+               cmdbase = skipwhite(cmdbase + 2);
+               flags = CREATE_NO_WINDOW;
+               si.dwFlags = STARTF_USESTDHANDLES;
+               si.hStdInput = CreateFile("\\\\.\\NUL",       // File name
+                   GENERIC_READ,                               // Access flags
+                   0,                                  // Share flags
+                   NULL,                                       // Security att.
+                   OPEN_EXISTING,                              // Open flags
+                   FILE_ATTRIBUTE_NORMAL,                      // File att.
+                   NULL);                                      // Temp file
+               si.hStdOutput = si.hStdInput;
+               si.hStdError = si.hStdInput;
+           }
+
+           /* When the command is in double quotes, but 'shellxquote' is
+            * empty, keep the double quotes around the command.
+            * Otherwise remove the double quotes, they aren't needed
+            * here, because we don't use a shell to run the command. */
+           if (cmdbase[strlen(cmdbase)-1] == ')')
+                   cmdbase[strlen(cmdbase)-1] = '\0';
+
+           /*
+            * Now, start the command as a process, so that it doesn't
+            * inherit our handles which causes unpleasant dangling swap
+            * files if we exit before the spawned process
+            */
+           if (CreateProcess(NULL,             // Executable name
+                   cmdbase,                    // Command to execute
+                   NULL,                       // Process security attributes
+                   NULL,                       // Thread security attributes
+                   FALSE,                      // Inherit handles
+                   flags,                      // Creation flags
+                   NULL,                       // Environment
+                   NULL,                       // Current directory
+                   &si,                    // Startup information
+                   &pi))                   // Process information
+               x = 0;
+           else
+           {
+               x = -1;
+#ifdef FEAT_GUI_W32
+               EMSG(_("E371: Command not found"));
+#endif
+           }
+           if (si.hStdInput != NULL)
+           {
+               /* Close the handle to \\.\NUL */
+               CloseHandle(si.hStdInput);
+           }
+           /* Close the handles to the subprocess, so that it goes away */
+           CloseHandle(pi.hThread);
+           CloseHandle(pi.hProcess);
+       }
+       else
+       {
+           char_u *newcmd;
+           long_u cmdlen =  (
 #ifdef FEAT_GUI_W32
                (allowPiping && !p_stmp ? 0 : STRLEN(vimrun_path)) +
 #endif
                STRLEN(p_sh) + STRLEN(p_shcf) + STRLEN(cmd) + 10);

-       newcmd = lalloc(cmdlen, TRUE);
-       if (newcmd != NULL)
-       {
-           char_u *cmdbase = cmd;
-
-           /* Skip a leading ", ( and "(. */
-           if (*cmdbase == '"' )
-               ++cmdbase;
-           if (*cmdbase == '(')
-               ++cmdbase;
-           if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
-           {
-               STARTUPINFO             si;
-               PROCESS_INFORMATION     pi;
-               DWORD                   flags = CREATE_NEW_CONSOLE;
-
-               si.cb = sizeof(si);
-               si.lpReserved = NULL;
-               si.lpDesktop = NULL;
-               si.lpTitle = NULL;
-               si.dwFlags = 0;
-               si.cbReserved2 = 0;
-               si.lpReserved2 = NULL;
-
-               cmdbase = skipwhite(cmdbase + 5);
-               if ((STRNICMP(cmdbase, "/min", 4) == 0)
-                       && vim_iswhite(cmdbase[4]))
-               {
-                   cmdbase = skipwhite(cmdbase + 4);
-                   si.dwFlags = STARTF_USESHOWWINDOW;
-                   si.wShowWindow = SW_SHOWMINNOACTIVE;
-               }
-               else if ((STRNICMP(cmdbase, "/b", 2) == 0)
-                       && vim_iswhite(cmdbase[2]))
-               {
-                   cmdbase = skipwhite(cmdbase + 2);
-                   flags = CREATE_NO_WINDOW;
-                   si.dwFlags = STARTF_USESTDHANDLES;
-                   si.hStdInput = CreateFile("\\\\.\\NUL",   // File name
-                       GENERIC_READ,                           // Access flags
-                       0,                                      // Share flags
-                       NULL,                                   // Security att.
-                       OPEN_EXISTING,                          // Open flags
-                       FILE_ATTRIBUTE_NORMAL,                  // File att.
-                       NULL);                                  // Temp file
-                   si.hStdOutput = si.hStdInput;
-                   si.hStdError = si.hStdInput;
-               }
-
-               /* When the command is in double quotes, but 'shellxquote' is
-                * empty, keep the double quotes around the command.
-                * Otherwise remove the double quotes, they aren't needed
-                * here, because we don't use a shell to run the command. */
-               if (cmdbase > cmd)
-               {
-                   if (STRNCMP(cmd, p_sxq, cmd - cmdbase) != 0)
-                   {
-                       STRCPY(newcmd, cmd);
-                   }
-                   else
-                   {
-                       char_u *p;
-
-                       STRCPY(newcmd, cmdbase);
-                       /* Remove a trailing ", ) and )" if they have a match
-                        * at the start of the command. */
-                       p = newcmd + STRLEN(newcmd);
-                       if (p > newcmd && p[-1] == '"' && *cmd == '"')
-                           *--p = NUL;
-                       if (p > newcmd && p[-1] == ')'
-                                            && (*cmd =='(' || cmd[1] == '('))
-                           *--p = NUL;
-                   }
-               }
-
-               /*
-                * Now, start the command as a process, so that it doesn't
-                * inherit our handles which causes unpleasant dangling swap
-                * files if we exit before the spawned process
-                */
-               if (CreateProcess(NULL,         // Executable name
-                       newcmd,                 // Command to execute
-                       NULL,                   // Process security attributes
-                       NULL,                   // Thread security attributes
-                       FALSE,                  // Inherit handles
-                       flags,                  // Creation flags
-                       NULL,                   // Environment
-                       NULL,                   // Current directory
-                       &si,                        // Startup information
-                       &pi))                       // Process information
-                   x = 0;
-               else
-               {
-                   x = -1;
-#ifdef FEAT_GUI_W32
-                   EMSG(_("E371: Command not found"));
-#endif
-               }
-               if (si.hStdInput != NULL)
-               {
-                   /* Close the handle to \\.\NUL */
-                   CloseHandle(si.hStdInput);
-               }
-               /* Close the handles to the subprocess, so that it goes away */
-               CloseHandle(pi.hThread);
-               CloseHandle(pi.hProcess);
-           }
-           else
+           newcmd = lalloc(cmdlen, TRUE);
+           if (newcmd != NULL)
            {
 #if defined(FEAT_GUI_W32)
                if (need_vimrun_warning)
@@ -4036,10 +4017,10 @@
                else
 #endif
                    vim_snprintf((char *)newcmd, cmdlen, "%s %s %s",
-                                                          p_sh, p_shcf, cmd);
+                                                      p_sh, p_shcf, cmd);
                x = mch_system((char *)newcmd, options);
+               vim_free(newcmd);
            }
-           vim_free(newcmd);
        }
     }

thanks.
:!start command is working.
but, vim7.3.443's default value is not working.

gvim7.3.446.exe -u NONE
:set shellcmdflag=/s\ /c
:set shellxquote=\"

:!start explorer.exe C:\Documents and Settings
this command is working.

:!start explorer.exe
this command is return E371: Command not found.

Thanks your testing. :)

https://raw.github.com/gist/1872858/gistfile1.diff

diff -r 068bb8a58a4e src/os_win32.c
--- a/src/os_win32.c Mon Feb 20 22:18:30 2012 +0100
+++ b/src/os_win32.c Tue Feb 21 10:40:10 2012 +0900
@@ -3898,121 +3898,107 @@
     else
     {
  /* we use "command" or "cmd" to start the shell; slow but easy */
- char_u *newcmd;
- long_u cmdlen =  (
+ char_u *cmdbase = cmd;
+
+ /* Skip a leading ", ( and "(. */
+ if (*cmdbase == '"' )
+    ++cmdbase;
+ if (*cmdbase == '(')
+    ++cmdbase;
+ if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
+ {
+    STARTUPINFO si;
+    PROCESS_INFORMATION pi;
+    DWORD flags = CREATE_NEW_CONSOLE;
+
+    si.cb = sizeof(si);
+    si.lpReserved = NULL;
+    si.lpDesktop = NULL;
+    si.lpTitle = NULL;
+    si.dwFlags = 0;
+    si.cbReserved2 = 0;
+    si.lpReserved2 = NULL;
+
+    cmdbase = skipwhite(cmdbase + 5);
+    if ((STRNICMP(cmdbase, "/min", 4) == 0)
+    && vim_iswhite(cmdbase[4]))
+    {
+ cmdbase = skipwhite(cmdbase + 4);
+ si.dwFlags = STARTF_USESHOWWINDOW;
+ si.wShowWindow = SW_SHOWMINNOACTIVE;
+    }
+    else if ((STRNICMP(cmdbase, "/b", 2) == 0)
+    && vim_iswhite(cmdbase[2]))
+    {
+ cmdbase = skipwhite(cmdbase + 2);
+ flags = CREATE_NO_WINDOW;
+ si.dwFlags = STARTF_USESTDHANDLES;
+ si.hStdInput = CreateFile("\\\\.\\NUL", // File name
+    GENERIC_READ, // Access flags
+    0, // Share flags
+    NULL, // Security att.
+    OPEN_EXISTING, // Open flags
+    FILE_ATTRIBUTE_NORMAL, // File att.
+    NULL); // Temp file
+ si.hStdOutput = si.hStdInput;
+ si.hStdError = si.hStdInput;
+    }
+
+    /* Remove a trailing ", ) and )" if they have a match
+     * at the start of the command. */
+    if (cmdbase > cmd)
+    {
+ char_u *p = cmdbase + STRLEN(cmdbase);
+ if (p > cmdbase && p[-1] == '"' && *cmd == '"')
+    *--p = NUL;
+ if (p > cmdbase && p[-1] == ')'
+ && (*cmd =='(' || cmd[1] == '('))
+    *--p = NUL;
+    }
+
+    /*
+     * Now, start the command as a process, so that it doesn't
+     * inherit our handles which causes unpleasant dangling swap
+     * files if we exit before the spawned process
+     */
+    if (CreateProcess(NULL, // Executable name
+    cmdbase, // Command to execute
+    NULL, // Process security attributes
+    NULL, // Thread security attributes
+    FALSE, // Inherit handles
+    flags, // Creation flags
+    NULL, // Environment
+    NULL, // Current directory
+    &si, // Startup information
+    &pi)) // Process information
+ x = 0;
+    else
+    {
+ x = -1;
+#ifdef FEAT_GUI_W32
+ EMSG(_("E371: Command not found"));
+#endif
+    }
+    if (si.hStdInput != NULL)
+    {
+ /* Close the handle to \\.\NUL */
+ CloseHandle(si.hStdInput);
+    }
+    /* Close the handles to the subprocess, so that it goes away */
+    CloseHandle(pi.hThread);
+    CloseHandle(pi.hProcess);
+ }
+ else
+ {
+    char_u *newcmd;
+    long_u cmdlen =  (
 #ifdef FEAT_GUI_W32
  (allowPiping && !p_stmp ? 0 : STRLEN(vimrun_path)) +
 #endif
  STRLEN(p_sh) + STRLEN(p_shcf) + STRLEN(cmd) + 10);

- newcmd = lalloc(cmdlen, TRUE);
- if (newcmd != NULL)
- {
-    char_u *cmdbase = cmd;
-
-    /* Skip a leading ", ( and "(. */
-    if (*cmdbase == '"' )
- ++cmdbase;
-    if (*cmdbase == '(')
- ++cmdbase;
-    if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
-    {
- STARTUPINFO si;
- PROCESS_INFORMATION pi;
- DWORD flags = CREATE_NEW_CONSOLE;
-
- si.cb = sizeof(si);
- si.lpReserved = NULL;
- si.lpDesktop = NULL;
- si.lpTitle = NULL;
- si.dwFlags = 0;
- si.cbReserved2 = 0;
- si.lpReserved2 = NULL;
-
- cmdbase = skipwhite(cmdbase + 5);
- if ((STRNICMP(cmdbase, "/min", 4) == 0)
- && vim_iswhite(cmdbase[4]))
- {
-    cmdbase = skipwhite(cmdbase + 4);
-    si.dwFlags = STARTF_USESHOWWINDOW;
-    si.wShowWindow = SW_SHOWMINNOACTIVE;
- }
- else if ((STRNICMP(cmdbase, "/b", 2) == 0)
- && vim_iswhite(cmdbase[2]))
- {
-    cmdbase = skipwhite(cmdbase + 2);
-    flags = CREATE_NO_WINDOW;
-    si.dwFlags = STARTF_USESTDHANDLES;
-    si.hStdInput = CreateFile("\\\\.\\NUL", // File name
- GENERIC_READ, // Access flags
- 0, // Share flags
- NULL, // Security att.
- OPEN_EXISTING, // Open flags
- FILE_ATTRIBUTE_NORMAL, // File att.
- NULL); // Temp file
-    si.hStdOutput = si.hStdInput;
-    si.hStdError = si.hStdInput;
- }
-
- /* When the command is in double quotes, but 'shellxquote' is
- * empty, keep the double quotes around the command.
- * Otherwise remove the double quotes, they aren't needed
- * here, because we don't use a shell to run the command. */
- if (cmdbase > cmd)
- {
-    if (STRNCMP(cmd, p_sxq, cmd - cmdbase) != 0)
-    {
- STRCPY(newcmd, cmd);
-    }
-    else
-    {
- char_u *p;
-
- STRCPY(newcmd, cmdbase);
- /* Remove a trailing ", ) and )" if they have a match
- * at the start of the command. */
- p = newcmd + STRLEN(newcmd);
- if (p > newcmd && p[-1] == '"' && *cmd == '"')
-    *--p = NUL;
- if (p > newcmd && p[-1] == ')'
-     && (*cmd =='(' || cmd[1] == '('))
-    *--p = NUL;
-    }
- }
-
- /*
- * Now, start the command as a process, so that it doesn't
- * inherit our handles which causes unpleasant dangling swap
- * files if we exit before the spawned process
- */
- if (CreateProcess(NULL, // Executable name
- newcmd, // Command to execute
- NULL, // Process security attributes
- NULL, // Thread security attributes
- FALSE, // Inherit handles
- flags, // Creation flags
- NULL, // Environment
- NULL, // Current directory
- &si, // Startup information
- &pi)) // Process information
-    x = 0;
- else
- {
-    x = -1;
-#ifdef FEAT_GUI_W32
-    EMSG(_("E371: Command not found"));
-#endif
- }
- if (si.hStdInput != NULL)
- {
-    /* Close the handle to \\.\NUL */
-    CloseHandle(si.hStdInput);
- }
- /* Close the handles to the subprocess, so that it goes away */
- CloseHandle(pi.hThread);
- CloseHandle(pi.hProcess);
-    }
-    else
+    newcmd = lalloc(cmdlen, TRUE);
+    if (newcmd != NULL)
     {
 #if defined(FEAT_GUI_W32)
  if (need_vimrun_warning)
@@ -4036,10 +4022,10 @@
  else
 #endif
     vim_snprintf((char *)newcmd, cmdlen, "%s %s %s",
-   p_sh, p_shcf, cmd);
+       p_sh, p_shcf, cmd);
  x = mch_system((char *)newcmd, options);
+ vim_free(newcmd);
     }
-    vim_free(newcmd);
  }
     }

start command is working in vim7.3.443's default value.

gvim7.3.446.exe -u NONE
:let &shellxescape = '&|<>()@^'
!start C:\cygwin-1.7\bin\mintty.exe -e /bin/bash.exe -l -c "cd $HOME; exec
/bin/bash.exe"
is working.

but,
:set shellxescape&
!start C:\cygwin-1.7\bin\mintty.exe -e /bin/bash.exe -l -c "cd $HOME; exec
/bin/bash.exe"
is not working.

since this is specification, is it unavoidable?

Ah, I notice the behavor. When :!start, It don't need all of workarounds ()
or shellxescape.
Sorry. This is my mistake. I'll fix soon.

add Unescape in shellxescape.

https://raw.github.com/gist/1873264/gistfile1.diff

diff -r 068bb8a58a4e src/os_win32.c
--- a/src/os_win32.c    Mon Feb 20 22:18:30 2012 +0100
+++ b/src/os_win32.c    Tue Feb 21 11:56:48 2012 +0900
@@ -3898,121 +3898,123 @@
     else
     {
        /* we use "command" or "cmd" to start the shell; slow but easy */
-       char_u *newcmd;
-       long_u cmdlen =  (
+       char_u *cmdbase = cmd;
+
+       /* Skip a leading ", ( and "(. */
+       if (*cmdbase == '"' )
+           ++cmdbase;
+       if (*cmdbase == '(')
+           ++cmdbase;
+       if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
+       {
+           STARTUPINFO         si;
+           PROCESS_INFORMATION pi;
+           DWORD               flags = CREATE_NEW_CONSOLE;
+           char_u              *p;
+           int                 l;
+
+           si.cb = sizeof(si);
+           si.lpReserved = NULL;
+           si.lpDesktop = NULL;
+           si.lpTitle = NULL;
+           si.dwFlags = 0;
+           si.cbReserved2 = 0;
+           si.lpReserved2 = NULL;
+
+           cmdbase = skipwhite(cmdbase + 5);
+           if ((STRNICMP(cmdbase, "/min", 4) == 0)
+                   && vim_iswhite(cmdbase[4]))
+           {
+               cmdbase = skipwhite(cmdbase + 4);
+               si.dwFlags = STARTF_USESHOWWINDOW;
+               si.wShowWindow = SW_SHOWMINNOACTIVE;
+           }
+           else if ((STRNICMP(cmdbase, "/b", 2) == 0)
+                   && vim_iswhite(cmdbase[2]))
+           {
+               cmdbase = skipwhite(cmdbase + 2);
+               flags = CREATE_NO_WINDOW;
+               si.dwFlags = STARTF_USESTDHANDLES;
+               si.hStdInput = CreateFile("\\\\.\\NUL",       // File name
+                   GENERIC_READ,                               // Access flags
+                   0,                                  // Share flags
+                   NULL,                                       // Security att.
+                   OPEN_EXISTING,                              // Open flags
+                   FILE_ATTRIBUTE_NORMAL,                      // File att.
+                   NULL);                                      // Temp file
+               si.hStdOutput = si.hStdInput;
+               si.hStdError = si.hStdInput;
+           }
+
+           /* Remove a trailing ", ) and )" if they have a match
+            * at the start of the command. */
+           if (cmdbase > cmd)
+           {
+               p = cmdbase + STRLEN(cmdbase);
+               if (p > cmdbase && p[-1] == '"' && *cmd == '"')
+                   *--p = NUL;
+               if (p > cmdbase && p[-1] == ')'
+                       && (*cmd =='(' || cmd[1] == '('))
+                   *--p = NUL;
+           }
+
+           /* Remove characters in shellxescape. */
+           p = cmdbase;
+           l = STRLEN(cmdbase);
+           while (*p != NUL)
+           {
+               if (vim_strchr(p_sxe, *p) != NULL)
+                   mch_memmove(p, p + 1, --l);
+#ifdef FEAT_MBYTE
+               p += (*mb_ptr2len)(p);
+#else
+               p++;
+#endif
+           }
+
+           /*
+            * Now, start the command as a process, so that it doesn't
+            * inherit our handles which causes unpleasant dangling swap
+            * files if we exit before the spawned process
+            */
+           if (CreateProcess(NULL,             // Executable name
+                   cmdbase,                    // Command to execute
+                   NULL,                       // Process security attributes
+                   NULL,                       // Thread security attributes
+                   FALSE,                      // Inherit handles
+                   flags,                      // Creation flags
+                   NULL,                       // Environment
+                   NULL,                       // Current directory
+                   &si,                    // Startup information
+                   &pi))                   // Process information
+               x = 0;
+           else
+           {
+               x = -1;
+#ifdef FEAT_GUI_W32
+               EMSG(_("E371: Command not found"));
+#endif
+           }
+           if (si.hStdInput != NULL)
+           {
+               /* Close the handle to \\.\NUL */
+               CloseHandle(si.hStdInput);
+           }
+           /* Close the handles to the subprocess, so that it goes away */
+           CloseHandle(pi.hThread);
+           CloseHandle(pi.hProcess);
+       }
+       else
+       {
+           char_u *newcmd;
+           long_u cmdlen =  (
 #ifdef FEAT_GUI_W32
                (allowPiping && !p_stmp ? 0 : STRLEN(vimrun_path)) +
 #endif
                STRLEN(p_sh) + STRLEN(p_shcf) + STRLEN(cmd) + 10);

-       newcmd = lalloc(cmdlen, TRUE);
-       if (newcmd != NULL)
-       {
-           char_u *cmdbase = cmd;
-
-           /* Skip a leading ", ( and "(. */
-           if (*cmdbase == '"' )
-               ++cmdbase;
-           if (*cmdbase == '(')
-               ++cmdbase;
-           if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
-           {
-               STARTUPINFO             si;
-               PROCESS_INFORMATION     pi;
-               DWORD                   flags = CREATE_NEW_CONSOLE;
-
-               si.cb = sizeof(si);
-               si.lpReserved = NULL;
-               si.lpDesktop = NULL;
-               si.lpTitle = NULL;
-               si.dwFlags = 0;
-               si.cbReserved2 = 0;
-               si.lpReserved2 = NULL;
-
-               cmdbase = skipwhite(cmdbase + 5);
-               if ((STRNICMP(cmdbase, "/min", 4) == 0)
-                       && vim_iswhite(cmdbase[4]))
-               {
-                   cmdbase = skipwhite(cmdbase + 4);
-                   si.dwFlags = STARTF_USESHOWWINDOW;
-                   si.wShowWindow = SW_SHOWMINNOACTIVE;
-               }
-               else if ((STRNICMP(cmdbase, "/b", 2) == 0)
-                       && vim_iswhite(cmdbase[2]))
-               {
-                   cmdbase = skipwhite(cmdbase + 2);
-                   flags = CREATE_NO_WINDOW;
-                   si.dwFlags = STARTF_USESTDHANDLES;
-                   si.hStdInput = CreateFile("\\\\.\\NUL",   // File name
-                       GENERIC_READ,                           // Access flags
-                       0,                                      // Share flags
-                       NULL,                                   // Security att.
-                       OPEN_EXISTING,                          // Open flags
-                       FILE_ATTRIBUTE_NORMAL,                  // File att.
-                       NULL);                                  // Temp file
-                   si.hStdOutput = si.hStdInput;
-                   si.hStdError = si.hStdInput;
-               }
-
-               /* When the command is in double quotes, but 'shellxquote' is
-                * empty, keep the double quotes around the command.
-                * Otherwise remove the double quotes, they aren't needed
-                * here, because we don't use a shell to run the command. */
-               if (cmdbase > cmd)
-               {
-                   if (STRNCMP(cmd, p_sxq, cmd - cmdbase) != 0)
-                   {
-                       STRCPY(newcmd, cmd);
-                   }
-                   else
-                   {
-                       char_u *p;
-
-                       STRCPY(newcmd, cmdbase);
-                       /* Remove a trailing ", ) and )" if they have a match
-                        * at the start of the command. */
-                       p = newcmd + STRLEN(newcmd);
-                       if (p > newcmd && p[-1] == '"' && *cmd == '"')
-                           *--p = NUL;
-                       if (p > newcmd && p[-1] == ')'
-                                            && (*cmd =='(' || cmd[1] == '('))
-                           *--p = NUL;
-                   }
-               }
-
-               /*
-                * Now, start the command as a process, so that it doesn't
-                * inherit our handles which causes unpleasant dangling swap
-                * files if we exit before the spawned process
-                */
-               if (CreateProcess(NULL,         // Executable name
-                       newcmd,                 // Command to execute
-                       NULL,                   // Process security attributes
-                       NULL,                   // Thread security attributes
-                       FALSE,                  // Inherit handles
-                       flags,                  // Creation flags
-                       NULL,                   // Environment
-                       NULL,                   // Current directory
-                       &si,                        // Startup information
-                       &pi))                       // Process information
-                   x = 0;
-               else
-               {
-                   x = -1;
-#ifdef FEAT_GUI_W32
-                   EMSG(_("E371: Command not found"));
-#endif
-               }
-               if (si.hStdInput != NULL)
-               {
-                   /* Close the handle to \\.\NUL */
-                   CloseHandle(si.hStdInput);
-               }
-               /* Close the handles to the subprocess, so that it goes away */
-               CloseHandle(pi.hThread);
-               CloseHandle(pi.hProcess);
-           }
-           else
+           newcmd = lalloc(cmdlen, TRUE);
+           if (newcmd != NULL)
            {
 #if defined(FEAT_GUI_W32)
                if (need_vimrun_warning)
@@ -4038,8 +4040,8 @@
                    vim_snprintf((char *)newcmd, cmdlen, "%s %s %s",
                                                           p_sh, p_shcf, cmd);
                x = mch_system((char *)newcmd, options);
+               vim_free(newcmd);
            }
-           vim_free(newcmd);
        }
     }

thanks.
Would you also correct 'noshelltemp' option?

gvim7.3.446.exe -u NONE
:set noshelltemp
:set shellxquote&
:echo system('ls')

ls: cannot access >c:\cygwin-1.7\tmp\VIo475.tmp: No such file or directory
ls: cannot access 2>&1: No such file or directory
E484: Can't open file c:\cygwin-1.7\tmp\VIo475.tmp

:set shelltemp
:set shellxquote&
:echo system('ls')

or

:set noshelltemp
:set shellxquote=
:echo system('ls')

is working.

Hmm, I can't reproduce it with 446+my patch.

C:\>set PATH=c:/cygwin/bin;%PATH%
C:\>vim -u NONE
:set noshelltemp
:set shellxquote&
:echo system('which ls')
/usr/bin/ls
:echo system('pwd')
/cygdrive/c
:echo len(system('ls'))
2228

Ah, It occur on gvim.exe not vim.exe.

oops. This patch is broken. X-(
I'll fix.

probably, this fixes both following.

* :!start problem
* cygwin system("ls") problem

https://raw.github.com/gist/1873927/gistfile1.diff

diff -r 068bb8a58a4e src/os_win32.c
--- a/src/os_win32.c Mon Feb 20 22:18:30 2012 +0100
+++ b/src/os_win32.c Tue Feb 21 14:20:18 2012 +0900
@@ -3559,6 +3559,7 @@
     garray_T ga;
     int    delay = 1;
     DWORD buffer_off = 0; /* valid bytes in buffer[] */
+    char_u *p, *pcmd = NULL;

     SECURITY_ATTRIBUTES saAttr;

@@ -3599,9 +3600,32 @@
     if (options & SHELL_READ)
  ga_init2(&ga, 1, BUFLEN);

+    if (cmd)
+    {
+ char_u *p;
+ int l, n;
+ pcmd = p = (char *)vim_strsave(cmd);
+ if (p)
+ {
+    l = STRLEN(p);
+    while (*p != NUL)
+    {
+ if (*p == '^' && vim_strchr(p_sxe, *(p+1)) != NULL)
+    mch_memmove(p, p + 1, --l+1);
+#ifdef FEAT_MBYTE
+ n = (*mb_ptr2len)(p);
+#else
+ n = 1;
+#endif
+ p += n;
+ l -= n;
+    }
+ }
+    }
+
     /* Now, run the command */
     CreateProcess(NULL, /* Executable name */
-  cmd, /* Command to execute */
+  pcmd, /* Command to execute */
   NULL, /* Process security attributes */
   NULL, /* Thread security attributes */

@@ -3616,6 +3640,7 @@
   &si, /* Startup information */
   &pi); /* Process information */

+    vim_free(pcmd);

     /* Close our unused side of the pipes */
     CloseHandle(g_hChildStd_IN_Rd);
@@ -3898,121 +3923,125 @@
     else
     {
  /* we use "command" or "cmd" to start the shell; slow but easy */
- char_u *newcmd;
- long_u cmdlen =  (
+ char_u *cmdbase = cmd;
+
+ /* Skip a leading ", ( and "(. */
+ if (*cmdbase == '"' )
+    ++cmdbase;
+ if (*cmdbase == '(')
+    ++cmdbase;
+ if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
+ {
+    STARTUPINFO si;
+    PROCESS_INFORMATION pi;
+    DWORD flags = CREATE_NEW_CONSOLE;
+    char_u *p;
+    int l, n;
+
+    si.cb = sizeof(si);
+    si.lpReserved = NULL;
+    si.lpDesktop = NULL;
+    si.lpTitle = NULL;
+    si.dwFlags = 0;
+    si.cbReserved2 = 0;
+    si.lpReserved2 = NULL;
+
+    cmdbase = skipwhite(cmdbase + 5);
+    if ((STRNICMP(cmdbase, "/min", 4) == 0)
+    && vim_iswhite(cmdbase[4]))
+    {
+ cmdbase = skipwhite(cmdbase + 4);
+ si.dwFlags = STARTF_USESHOWWINDOW;
+ si.wShowWindow = SW_SHOWMINNOACTIVE;
+    }
+    else if ((STRNICMP(cmdbase, "/b", 2) == 0)
+    && vim_iswhite(cmdbase[2]))
+    {
+ cmdbase = skipwhite(cmdbase + 2);
+ flags = CREATE_NO_WINDOW;
+ si.dwFlags = STARTF_USESTDHANDLES;
+ si.hStdInput = CreateFile("\\\\.\\NUL", // File name
+    GENERIC_READ, // Access flags
+    0, // Share flags
+    NULL, // Security att.
+    OPEN_EXISTING, // Open flags
+    FILE_ATTRIBUTE_NORMAL, // File att.
+    NULL); // Temp file
+ si.hStdOutput = si.hStdInput;
+ si.hStdError = si.hStdInput;
+    }
+
+    /* Remove a trailing ", ) and )" if they have a match
+     * at the start of the command. */
+    if (cmdbase > cmd)
+    {
+ p = cmdbase + STRLEN(cmdbase);
+ if (p > cmdbase && p[-1] == '"' && *cmd == '"')
+    *--p = NUL;
+ if (p > cmdbase && p[-1] == ')'
+ && (*cmd =='(' || cmd[1] == '('))
+    *--p = NUL;
+    }
+
+    /* Unescape characters in shellxescape. */
+    p = cmdbase;
+    l = STRLEN(cmdbase);
+    while (*p != NUL)
+    {
+ if (*p == '^' && vim_strchr(p_sxe, *(p+1)) != NULL)
+    mch_memmove(p, p + 1, --l+1);
+#ifdef FEAT_MBYTE
+ n = (*mb_ptr2len)(p);
+#else
+ n = 1;
+#endif
+ p += n;
+ l -= n;
+    }
+
+    /*
+     * Now, start the command as a process, so that it doesn't
+     * inherit our handles which causes unpleasant dangling swap
+     * files if we exit before the spawned process
+     */
+    if (CreateProcess(NULL, // Executable name
+    cmdbase, // Command to execute
+    NULL, // Process security attributes
+    NULL, // Thread security attributes
+    FALSE, // Inherit handles
+    flags, // Creation flags
+    NULL, // Environment
+    NULL, // Current directory
+    &si, // Startup information
+    &pi)) // Process information
+ x = 0;
+    else
+    {
+ x = -1;
+#ifdef FEAT_GUI_W32
+ EMSG(_("E371: Command not found"));
+#endif
+    }
+    if (si.hStdInput != NULL)
+    {
+ /* Close the handle to \\.\NUL */
+ CloseHandle(si.hStdInput);
+    }
+    /* Close the handles to the subprocess, so that it goes away */
+    CloseHandle(pi.hThread);
+    CloseHandle(pi.hProcess);
+ }
+ else
+ {
+    char_u *newcmd;
+    long_u cmdlen =  (
 #ifdef FEAT_GUI_W32
  (allowPiping && !p_stmp ? 0 : STRLEN(vimrun_path)) +
 #endif
  STRLEN(p_sh) + STRLEN(p_shcf) + STRLEN(cmd) + 10);

- newcmd = lalloc(cmdlen, TRUE);
- if (newcmd != NULL)
- {
-    char_u *cmdbase = cmd;
-
-    /* Skip a leading ", ( and "(. */
-    if (*cmdbase == '"' )
- ++cmdbase;
-    if (*cmdbase == '(')
- ++cmdbase;
-    if ((STRNICMP(cmdbase, "start", 5) == 0) && vim_iswhite(cmdbase[5]))
-    {
- STARTUPINFO si;
- PROCESS_INFORMATION pi;
- DWORD flags = CREATE_NEW_CONSOLE;
-
- si.cb = sizeof(si);
- si.lpReserved = NULL;
- si.lpDesktop = NULL;
- si.lpTitle = NULL;
- si.dwFlags = 0;
- si.cbReserved2 = 0;
- si.lpReserved2 = NULL;
-
- cmdbase = skipwhite(cmdbase + 5);
- if ((STRNICMP(cmdbase, "/min", 4) == 0)
- && vim_iswhite(cmdbase[4]))
- {
-    cmdbase = skipwhite(cmdbase + 4);
-    si.dwFlags = STARTF_USESHOWWINDOW;
-    si.wShowWindow = SW_SHOWMINNOACTIVE;
- }
- else if ((STRNICMP(cmdbase, "/b", 2) == 0)
- && vim_iswhite(cmdbase[2]))
- {
-    cmdbase = skipwhite(cmdbase + 2);
-    flags = CREATE_NO_WINDOW;
-    si.dwFlags = STARTF_USESTDHANDLES;
-    si.hStdInput = CreateFile("\\\\.\\NUL", // File name
- GENERIC_READ, // Access flags
- 0, // Share flags
- NULL, // Security att.
- OPEN_EXISTING, // Open flags
- FILE_ATTRIBUTE_NORMAL, // File att.
- NULL); // Temp file
-    si.hStdOutput = si.hStdInput;
-    si.hStdError = si.hStdInput;
- }
-
- /* When the command is in double quotes, but 'shellxquote' is
- * empty, keep the double quotes around the command.
- * Otherwise remove the double quotes, they aren't needed
- * here, because we don't use a shell to run the command. */
- if (cmdbase > cmd)
- {
-    if (STRNCMP(cmd, p_sxq, cmd - cmdbase) != 0)
-    {
- STRCPY(newcmd, cmd);
-    }
-    else
-    {
- char_u *p;
-
- STRCPY(newcmd, cmdbase);
- /* Remove a trailing ", ) and )" if they have a match
- * at the start of the command. */
- p = newcmd + STRLEN(newcmd);
- if (p > newcmd && p[-1] == '"' && *cmd == '"')
-    *--p = NUL;
- if (p > newcmd && p[-1] == ')'
-     && (*cmd =='(' || cmd[1] == '('))
-    *--p = NUL;
-    }
- }
-
- /*
- * Now, start the command as a process, so that it doesn't
- * inherit our handles which causes unpleasant dangling swap
- * files if we exit before the spawned process
- */
- if (CreateProcess(NULL, // Executable name
- newcmd, // Command to execute
- NULL, // Process security attributes
- NULL, // Thread security attributes
- FALSE, // Inherit handles
- flags, // Creation flags
- NULL, // Environment
- NULL, // Current directory
- &si, // Startup information
- &pi)) // Process information
-    x = 0;
- else
- {
-    x = -1;
-#ifdef FEAT_GUI_W32
-    EMSG(_("E371: Command not found"));
-#endif
- }
- if (si.hStdInput != NULL)
- {
-    /* Close the handle to \\.\NUL */
-    CloseHandle(si.hStdInput);
- }
- /* Close the handles to the subprocess, so that it goes away */
- CloseHandle(pi.hThread);
- CloseHandle(pi.hProcess);
-    }
-    else
+    newcmd = lalloc(cmdlen, TRUE);
+    if (newcmd != NULL)
     {
 #if defined(FEAT_GUI_W32)
  if (need_vimrun_warning)
@@ -4038,8 +4067,8 @@
     vim_snprintf((char *)newcmd, cmdlen, "%s %s %s",
    p_sh, p_shcf, cmd);
  x = mch_system((char *)newcmd, options);
+ vim_free(newcmd);
     }
-    vim_free(newcmd);
  }
     }

'noshelltemp' option is working.

from https://github.com/thinca/vim-ref/blob/master/autoload/ref.vim#L383
ref#system()
:set noshelltemp
:set shellxquote=
:let &shellredir = '>%s 2>' . shellescape(tempname())
:echo system('""ghc-mod" "type" "./grep.hs" "main" "gcd""')
E484: Can't open file c:/cygwin-1.7/tmp/VIo730.tmp

:set noshelltemp
:set shellxquote=    or   set shellxquote="
:let &shellredir = '>%s 2>' . tempname()
:echo system('""ghc-mod" "type" "./grep.hs" "main" "gcd""')

or

:set noshelltemp
:set shellxquote=(
:let &shellredir = '>%s 2>' . tempname()
:echo system('"ghc-mod" "type" "./grep.hs" "main" "gcd"')

is working.

where is grep.hs?

sorry.

:set noshelltemp
:set shellxquote=
:let &shellredir = '>%s 2>' . shellescape(tempname())
:echo system('""ls""')
The filename, directory name, or volume label syntax is incorrect.

:set noshelltemp
:set shellxquote=    or   set shellxquote="
:let &shellredir = '>%s 2>' . tempname()
:echo system('""ls""')   or   :echo system('"ls"')

or

:set noshelltemp
:set shellxquote=(
:let &shellredir = '>%s 2>' . tempname()
:echo system('""ls""')   or   :echo system('"ls"')

is working.

operation check

:!start command is not working /b option,
if pipe | is contained in the command.

:!start cmd /c "ls | nkf -s > ./test.txt"
:!start /b cmd /c "touch ./test2.txt"
is working.

:!start /b cmd /c "ls | nkf -s > ./test.txt"
is not working.

Hmm, I can't say that Patch 7.3.445 and Patch 7.3.446 are best, so I wonder
what should do.

Ah, /b option does not work correctly with pipe character before applying
the patch.

Sorry. I can't write patch without workaround.

https://raw.github.com/gist/1875496/gistfile1.diff

:!start command is working /b option,

but,
:!start C:\cygwin-1.7\bin\mintty.exe -e /bin/bash.exe -l -c "cd $HOME; exec
/bin/bash.exe"
gvim freezes.

This is my bug... :-/

https://raw.github.com/gist/1875806/gistfile1.diff

thanks very very much.
:!start /b cmd /c ack -H --nocolor --nogroup --column  "hoge" > ./test.txt
& vim --servername GVIMD1 --remote "test.txt"
is working.

You are welcome. But I'm not vim boss.

When invoking unescape_shellxquote() with the argument "<>" this means
only redirection will be unescaped.  But the comment says the opposite.
So what is the correct behavior?

Since the code has been tested I'll assume the comment is wrong.

I'll send out the patch soon, it looks like this is the only way to find
all the problems.

--
From "know your smileys":
 y:-)   Bad toupee

 /// Bram Moolenaar -- B...@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///