Add a CAVEATS section to warn programmers that shell meta-characters will

be passed to the command interpreter.

src/lib/libc/stdlib/system.3

@@ -33,7 +33,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     $OpenBSD: system.3,v 1.7 2000/04/20 13:50:03 aaron Exp $
+.\"     $OpenBSD: system.3,v 1.8 2000/10/06 04:17:51 aaron Exp $
 .\"
 .Dd June 29, 1991
 .Dt SYSTEM 3
@@ -93,3 +93,11 @@ function conforms to
 .St -ansiC
 and
 .St -p1003.2-92 .
+.Sh CAVEATS
+Never supply the
+.Fn system
+function with a command containing any part of an unsanitized user-supplied
+string.
+Shell meta-characters present will be honored by the
+.Xr sh 1
+command interpreter.