how to avoid shell=True in subprocess

Question

I have subprocess command to check md5 checksum as

subprocess.check_output(\'md5 Downloads/test.txt\', stderr=subprocess.STDOUT, shell=True)

Answer 1

Just pass the arguments to check_output() as a list:

subprocess.check_output(["md5", "Downloads/test.txt"], stderr=subprocess.STDOUT)

From the docs:

args is required for all calls and should be a string, or a sequence of program arguments. Providing a sequence of arguments is generally preferred, as it allows the module to take care of any required escaping and quoting of arguments (e.g. to permit spaces in file names). If passing a single string, either shell must be True (see below) or else the string must simply name the program to be executed without specifying any arguments.