How to execute a bash command stored as a string with quotes and asterisk [duplicate]










205
















This question already has an answer here:



  • Why does shell ignore quotes in arguments passed to it through variables? [duplicate]

    3 answers



I try to execute the following command :



mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"


I store it in a string :



cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""


Test it :



echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"


Try to execute by doing :



$cmd


And I get the help page of mysql :



mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)


I guess I am doing something plain wrong with the quotes but can't find out what is the problem.










share|improve this question















marked as duplicate by tripleee bash
Users with the  bash badge can single-handedly close bash questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Apr 20 '16 at 11:17


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.













  • 9





    I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

    – Dennis Williamson
    Jan 5 '10 at 11:43






  • 4





    @DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

    – sdaau
    May 30 '13 at 20:26











  • @sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

    – Charles Duffy
    Aug 28 '15 at 21:25







  • 5





    The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

    – Charles Duffy
    Aug 28 '15 at 21:30












  • @DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

    – mobibob
    Oct 9 '18 at 20:06
















205
















This question already has an answer here:



  • Why does shell ignore quotes in arguments passed to it through variables? [duplicate]

    3 answers



I try to execute the following command :



mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"


I store it in a string :



cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""


Test it :



echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"


Try to execute by doing :



$cmd


And I get the help page of mysql :



mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)


I guess I am doing something plain wrong with the quotes but can't find out what is the problem.










share|improve this question















marked as duplicate by tripleee bash
Users with the  bash badge can single-handedly close bash questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Apr 20 '16 at 11:17


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.













  • 9





    I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

    – Dennis Williamson
    Jan 5 '10 at 11:43






  • 4





    @DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

    – sdaau
    May 30 '13 at 20:26











  • @sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

    – Charles Duffy
    Aug 28 '15 at 21:25







  • 5





    The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

    – Charles Duffy
    Aug 28 '15 at 21:30












  • @DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

    – mobibob
    Oct 9 '18 at 20:06














205












205








205


41







This question already has an answer here:



  • Why does shell ignore quotes in arguments passed to it through variables? [duplicate]

    3 answers



I try to execute the following command :



mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"


I store it in a string :



cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""


Test it :



echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"


Try to execute by doing :



$cmd


And I get the help page of mysql :



mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)


I guess I am doing something plain wrong with the quotes but can't find out what is the problem.










share|improve this question

















This question already has an answer here:



  • Why does shell ignore quotes in arguments passed to it through variables? [duplicate]

    3 answers



I try to execute the following command :



mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"


I store it in a string :



cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""


Test it :



echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"


Try to execute by doing :



$cmd


And I get the help page of mysql :



mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)


I guess I am doing something plain wrong with the quotes but can't find out what is the problem.





This question already has an answer here:



  • Why does shell ignore quotes in arguments passed to it through variables? [duplicate]

    3 answers







bash scripting escaping quotes






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Feb 14 '13 at 2:25









Stephane Rolland

19.3k2699147




19.3k2699147










asked Jan 5 '10 at 9:55









BarthBarth

6,360135896




6,360135896




marked as duplicate by tripleee bash
Users with the  bash badge can single-handedly close bash questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Apr 20 '16 at 11:17


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.









marked as duplicate by tripleee bash
Users with the  bash badge can single-handedly close bash questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Apr 20 '16 at 11:17


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.









  • 9





    I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

    – Dennis Williamson
    Jan 5 '10 at 11:43






  • 4





    @DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

    – sdaau
    May 30 '13 at 20:26











  • @sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

    – Charles Duffy
    Aug 28 '15 at 21:25







  • 5





    The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

    – Charles Duffy
    Aug 28 '15 at 21:30












  • @DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

    – mobibob
    Oct 9 '18 at 20:06













  • 9





    I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

    – Dennis Williamson
    Jan 5 '10 at 11:43






  • 4





    @DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

    – sdaau
    May 30 '13 at 20:26











  • @sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

    – Charles Duffy
    Aug 28 '15 at 21:25







  • 5





    The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

    – Charles Duffy
    Aug 28 '15 at 21:30












  • @DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

    – mobibob
    Oct 9 '18 at 20:06








9




9





I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

– Dennis Williamson
Jan 5 '10 at 11:43





I recommend that you read this: mywiki.wooledge.org/BashFAQ/050

– Dennis Williamson
Jan 5 '10 at 11:43




4




4





@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

– sdaau
May 30 '13 at 20:26





@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...

– sdaau
May 30 '13 at 20:26













@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

– Charles Duffy
Aug 28 '15 at 21:25






@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with declare -f; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo.

– Charles Duffy
Aug 28 '15 at 21:25





5




5





The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

– Charles Duffy
Aug 28 '15 at 21:30






The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using eval, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).

– Charles Duffy
Aug 28 '15 at 21:30














@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

– mobibob
Oct 9 '18 at 20:06






@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??

– mobibob
Oct 9 '18 at 20:06













5 Answers
5






active

oldest

votes


















298














Have you tried:



eval $cmd


For the follow-on question of how to escape * since it has special meaning when it's naked or in double quoted strings: use single quotes.



MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"


Bonus: It also reads nice: eval mysql query ;-)






share|improve this answer

























  • Thanks, it works. How would I select all columns ? How can I escape '*' ?

    – Barth
    Jan 5 '10 at 10:33






  • 1





    See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

    – Charles Duffy
    Sep 18 '15 at 19:16






  • 1





    ...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

    – Charles Duffy
    Sep 18 '15 at 19:17






  • 1





    @joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

    – Charles Duffy
    Oct 19 '17 at 18:02







  • 1





    @joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

    – Charles Duffy
    Oct 19 '17 at 18:04



















38














Use an array, not a string, as given as guidance in BashFAQ #50.



Using a string is extremely bad security practice: Consider the case where password (or a where clause in the query, or any other component) is user-provided; you don't want to eval a password containing $(rm -rf .)!




Just Running A Local Command



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"


Printing Your Command Unambiguously



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'


Running Your Command Over SSH (Method 1: Using Stdin)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"


Running Your Command Over SSH (Method 2: Command Line)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"





share|improve this answer




















  • 3





    Consider the case where no passwords are in the query. Think how useful it would be.

    – David Beckwith
    Aug 30 '15 at 6:55






  • 4





    @DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

    – Charles Duffy
    Aug 30 '15 at 15:24







  • 3





    ...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

    – Charles Duffy
    Aug 30 '15 at 15:31






  • 9





    It's more exciting if you have security vulnerabilities.

    – David Beckwith
    Aug 31 '15 at 8:59






  • 4





    I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

    – Charles Duffy
    Mar 28 '17 at 16:09


















22














try this



$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd





share|improve this answer


















  • 1





    thanks, it works. I marked the other answer as the accepted one because it came before.

    – Barth
    Jan 5 '10 at 10:32






  • 4





    To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

    – Charles Duffy
    Feb 3 '16 at 18:34







  • 4





    This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

    – jsears
    Feb 25 '16 at 16:23


















2














You don't need the "eval" even. Just put a dollar sign in front of the string:



cmd="ls"
$cmd





share|improve this answer


















  • 5





    Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

    – Charles Duffy
    Aug 28 '15 at 21:26






  • 2





    Read mywiki.wooledge.org/BashFAQ/050 to grok why.

    – Charles Duffy
    Aug 28 '15 at 21:27











  • this worked for me for a nodejs tool instead of `$cmd`

    – Paulo Oliveira
    Mar 31 '17 at 9:09












  • @PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

    – Charles Duffy
    Apr 29 '17 at 19:40






  • 1





    does not work in GitBash.

    – kyb
    Mar 23 '18 at 9:52


















-3














To eliminate the need for the cmd variable, you can do this:



eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'





share|improve this answer


















  • 3





    If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

    – Charles Duffy
    Aug 28 '15 at 21:26











  • eval with a constant literal makes no sense!

    – Sedat Kilinc
    Jan 1 '17 at 20:59

















5 Answers
5






active

oldest

votes








5 Answers
5






active

oldest

votes









active

oldest

votes






active

oldest

votes









298














Have you tried:



eval $cmd


For the follow-on question of how to escape * since it has special meaning when it's naked or in double quoted strings: use single quotes.



MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"


Bonus: It also reads nice: eval mysql query ;-)






share|improve this answer

























  • Thanks, it works. How would I select all columns ? How can I escape '*' ?

    – Barth
    Jan 5 '10 at 10:33






  • 1





    See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

    – Charles Duffy
    Sep 18 '15 at 19:16






  • 1





    ...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

    – Charles Duffy
    Sep 18 '15 at 19:17






  • 1





    @joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

    – Charles Duffy
    Oct 19 '17 at 18:02







  • 1





    @joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

    – Charles Duffy
    Oct 19 '17 at 18:04
















298














Have you tried:



eval $cmd


For the follow-on question of how to escape * since it has special meaning when it's naked or in double quoted strings: use single quotes.



MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"


Bonus: It also reads nice: eval mysql query ;-)






share|improve this answer

























  • Thanks, it works. How would I select all columns ? How can I escape '*' ?

    – Barth
    Jan 5 '10 at 10:33






  • 1





    See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

    – Charles Duffy
    Sep 18 '15 at 19:16






  • 1





    ...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

    – Charles Duffy
    Sep 18 '15 at 19:17






  • 1





    @joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

    – Charles Duffy
    Oct 19 '17 at 18:02







  • 1





    @joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

    – Charles Duffy
    Oct 19 '17 at 18:04














298












298








298







Have you tried:



eval $cmd


For the follow-on question of how to escape * since it has special meaning when it's naked or in double quoted strings: use single quotes.



MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"


Bonus: It also reads nice: eval mysql query ;-)






share|improve this answer















Have you tried:



eval $cmd


For the follow-on question of how to escape * since it has special meaning when it's naked or in double quoted strings: use single quotes.



MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"


Bonus: It also reads nice: eval mysql query ;-)







share|improve this answer














share|improve this answer



share|improve this answer








edited Jan 5 '10 at 15:27

























answered Jan 5 '10 at 9:57









slebetmanslebetman

67.8k1697123




67.8k1697123












  • Thanks, it works. How would I select all columns ? How can I escape '*' ?

    – Barth
    Jan 5 '10 at 10:33






  • 1





    See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

    – Charles Duffy
    Sep 18 '15 at 19:16






  • 1





    ...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

    – Charles Duffy
    Sep 18 '15 at 19:17






  • 1





    @joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

    – Charles Duffy
    Oct 19 '17 at 18:02







  • 1





    @joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

    – Charles Duffy
    Oct 19 '17 at 18:04


















  • Thanks, it works. How would I select all columns ? How can I escape '*' ?

    – Barth
    Jan 5 '10 at 10:33






  • 1





    See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

    – Charles Duffy
    Sep 18 '15 at 19:16






  • 1





    ...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

    – Charles Duffy
    Sep 18 '15 at 19:17






  • 1





    @joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

    – Charles Duffy
    Oct 19 '17 at 18:02







  • 1





    @joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

    – Charles Duffy
    Oct 19 '17 at 18:04

















Thanks, it works. How would I select all columns ? How can I escape '*' ?

– Barth
Jan 5 '10 at 10:33





Thanks, it works. How would I select all columns ? How can I escape '*' ?

– Barth
Jan 5 '10 at 10:33




1




1





See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

– Charles Duffy
Sep 18 '15 at 19:16





See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048

– Charles Duffy
Sep 18 '15 at 19:16




1




1





...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

– Charles Duffy
Sep 18 '15 at 19:17





...the literal quotes in the eval statement, when they become syntactic via use of eval, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.

– Charles Duffy
Sep 18 '15 at 19:17




1




1





@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

– Charles Duffy
Oct 19 '17 at 18:02






@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.

– Charles Duffy
Oct 19 '17 at 18:02





1




1





@joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

– Charles Duffy
Oct 19 '17 at 18:04






@joshmcode, (and yes, that matters here -- eval $cmd, unlike eval "$cmd", splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).

– Charles Duffy
Oct 19 '17 at 18:04














38














Use an array, not a string, as given as guidance in BashFAQ #50.



Using a string is extremely bad security practice: Consider the case where password (or a where clause in the query, or any other component) is user-provided; you don't want to eval a password containing $(rm -rf .)!




Just Running A Local Command



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"


Printing Your Command Unambiguously



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'


Running Your Command Over SSH (Method 1: Using Stdin)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"


Running Your Command Over SSH (Method 2: Command Line)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"





share|improve this answer




















  • 3





    Consider the case where no passwords are in the query. Think how useful it would be.

    – David Beckwith
    Aug 30 '15 at 6:55






  • 4





    @DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

    – Charles Duffy
    Aug 30 '15 at 15:24







  • 3





    ...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

    – Charles Duffy
    Aug 30 '15 at 15:31






  • 9





    It's more exciting if you have security vulnerabilities.

    – David Beckwith
    Aug 31 '15 at 8:59






  • 4





    I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

    – Charles Duffy
    Mar 28 '17 at 16:09















38














Use an array, not a string, as given as guidance in BashFAQ #50.



Using a string is extremely bad security practice: Consider the case where password (or a where clause in the query, or any other component) is user-provided; you don't want to eval a password containing $(rm -rf .)!




Just Running A Local Command



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"


Printing Your Command Unambiguously



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'


Running Your Command Over SSH (Method 1: Using Stdin)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"


Running Your Command Over SSH (Method 2: Command Line)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"





share|improve this answer




















  • 3





    Consider the case where no passwords are in the query. Think how useful it would be.

    – David Beckwith
    Aug 30 '15 at 6:55






  • 4





    @DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

    – Charles Duffy
    Aug 30 '15 at 15:24







  • 3





    ...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

    – Charles Duffy
    Aug 30 '15 at 15:31






  • 9





    It's more exciting if you have security vulnerabilities.

    – David Beckwith
    Aug 31 '15 at 8:59






  • 4





    I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

    – Charles Duffy
    Mar 28 '17 at 16:09













38












38








38







Use an array, not a string, as given as guidance in BashFAQ #50.



Using a string is extremely bad security practice: Consider the case where password (or a where clause in the query, or any other component) is user-provided; you don't want to eval a password containing $(rm -rf .)!




Just Running A Local Command



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"


Printing Your Command Unambiguously



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'


Running Your Command Over SSH (Method 1: Using Stdin)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"


Running Your Command Over SSH (Method 2: Command Line)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"





share|improve this answer















Use an array, not a string, as given as guidance in BashFAQ #50.



Using a string is extremely bad security practice: Consider the case where password (or a where clause in the query, or any other component) is user-provided; you don't want to eval a password containing $(rm -rf .)!




Just Running A Local Command



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"


Printing Your Command Unambiguously



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'


Running Your Command Over SSH (Method 1: Using Stdin)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"


Running Your Command Over SSH (Method 2: Command Line)



cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"






share|improve this answer














share|improve this answer



share|improve this answer








edited Apr 6 '18 at 17:18

























answered Aug 28 '15 at 21:34









Charles DuffyCharles Duffy

178k25200254




178k25200254







  • 3





    Consider the case where no passwords are in the query. Think how useful it would be.

    – David Beckwith
    Aug 30 '15 at 6:55






  • 4





    @DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

    – Charles Duffy
    Aug 30 '15 at 15:24







  • 3





    ...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

    – Charles Duffy
    Aug 30 '15 at 15:31






  • 9





    It's more exciting if you have security vulnerabilities.

    – David Beckwith
    Aug 31 '15 at 8:59






  • 4





    I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

    – Charles Duffy
    Mar 28 '17 at 16:09












  • 3





    Consider the case where no passwords are in the query. Think how useful it would be.

    – David Beckwith
    Aug 30 '15 at 6:55






  • 4





    @DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

    – Charles Duffy
    Aug 30 '15 at 15:24







  • 3





    ...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

    – Charles Duffy
    Aug 30 '15 at 15:31






  • 9





    It's more exciting if you have security vulnerabilities.

    – David Beckwith
    Aug 31 '15 at 8:59






  • 4





    I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

    – Charles Duffy
    Mar 28 '17 at 16:09







3




3





Consider the case where no passwords are in the query. Think how useful it would be.

– David Beckwith
Aug 30 '15 at 6:55





Consider the case where no passwords are in the query. Think how useful it would be.

– David Beckwith
Aug 30 '15 at 6:55




4




4





@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

– Charles Duffy
Aug 30 '15 at 15:24






@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.

– Charles Duffy
Aug 30 '15 at 15:24





3




3





...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

– Charles Duffy
Aug 30 '15 at 15:31





...that is to say: One can run cmd+=( -e "$query" ) to append those arguments to the existing array, and be assured that query will be added as a single argument to -e that's passed to mysql; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.

– Charles Duffy
Aug 30 '15 at 15:31




9




9





It's more exciting if you have security vulnerabilities.

– David Beckwith
Aug 31 '15 at 8:59





It's more exciting if you have security vulnerabilities.

– David Beckwith
Aug 31 '15 at 8:59




4




4





I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

– Charles Duffy
Mar 28 '17 at 16:09





I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".

– Charles Duffy
Mar 28 '17 at 16:09











22














try this



$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd





share|improve this answer


















  • 1





    thanks, it works. I marked the other answer as the accepted one because it came before.

    – Barth
    Jan 5 '10 at 10:32






  • 4





    To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

    – Charles Duffy
    Feb 3 '16 at 18:34







  • 4





    This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

    – jsears
    Feb 25 '16 at 16:23















22














try this



$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd





share|improve this answer


















  • 1





    thanks, it works. I marked the other answer as the accepted one because it came before.

    – Barth
    Jan 5 '10 at 10:32






  • 4





    To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

    – Charles Duffy
    Feb 3 '16 at 18:34







  • 4





    This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

    – jsears
    Feb 25 '16 at 16:23













22












22








22







try this



$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd





share|improve this answer













try this



$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd






share|improve this answer












share|improve this answer



share|improve this answer










answered Jan 5 '10 at 10:03









ghostdog74ghostdog74

221k41211302




221k41211302







  • 1





    thanks, it works. I marked the other answer as the accepted one because it came before.

    – Barth
    Jan 5 '10 at 10:32






  • 4





    To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

    – Charles Duffy
    Feb 3 '16 at 18:34







  • 4





    This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

    – jsears
    Feb 25 '16 at 16:23












  • 1





    thanks, it works. I marked the other answer as the accepted one because it came before.

    – Barth
    Jan 5 '10 at 10:32






  • 4





    To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

    – Charles Duffy
    Feb 3 '16 at 18:34







  • 4





    This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

    – jsears
    Feb 25 '16 at 16:23







1




1





thanks, it works. I marked the other answer as the accepted one because it came before.

– Barth
Jan 5 '10 at 10:32





thanks, it works. I marked the other answer as the accepted one because it came before.

– Barth
Jan 5 '10 at 10:32




4




4





To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

– Charles Duffy
Feb 3 '16 at 18:34






To the extent that it works, this works badly. Needs to be eval "$cmd", not eval $cmd, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.

– Charles Duffy
Feb 3 '16 at 18:34





4




4





This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

– jsears
Feb 25 '16 at 16:23





This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.

– jsears
Feb 25 '16 at 16:23











2














You don't need the "eval" even. Just put a dollar sign in front of the string:



cmd="ls"
$cmd





share|improve this answer


















  • 5





    Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

    – Charles Duffy
    Aug 28 '15 at 21:26






  • 2





    Read mywiki.wooledge.org/BashFAQ/050 to grok why.

    – Charles Duffy
    Aug 28 '15 at 21:27











  • this worked for me for a nodejs tool instead of `$cmd`

    – Paulo Oliveira
    Mar 31 '17 at 9:09












  • @PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

    – Charles Duffy
    Apr 29 '17 at 19:40






  • 1





    does not work in GitBash.

    – kyb
    Mar 23 '18 at 9:52















2














You don't need the "eval" even. Just put a dollar sign in front of the string:



cmd="ls"
$cmd





share|improve this answer


















  • 5





    Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

    – Charles Duffy
    Aug 28 '15 at 21:26






  • 2





    Read mywiki.wooledge.org/BashFAQ/050 to grok why.

    – Charles Duffy
    Aug 28 '15 at 21:27











  • this worked for me for a nodejs tool instead of `$cmd`

    – Paulo Oliveira
    Mar 31 '17 at 9:09












  • @PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

    – Charles Duffy
    Apr 29 '17 at 19:40






  • 1





    does not work in GitBash.

    – kyb
    Mar 23 '18 at 9:52













2












2








2







You don't need the "eval" even. Just put a dollar sign in front of the string:



cmd="ls"
$cmd





share|improve this answer













You don't need the "eval" even. Just put a dollar sign in front of the string:



cmd="ls"
$cmd






share|improve this answer












share|improve this answer



share|improve this answer










answered Aug 28 '15 at 21:22









David BeckwithDavid Beckwith

1,495107




1,495107







  • 5





    Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

    – Charles Duffy
    Aug 28 '15 at 21:26






  • 2





    Read mywiki.wooledge.org/BashFAQ/050 to grok why.

    – Charles Duffy
    Aug 28 '15 at 21:27











  • this worked for me for a nodejs tool instead of `$cmd`

    – Paulo Oliveira
    Mar 31 '17 at 9:09












  • @PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

    – Charles Duffy
    Apr 29 '17 at 19:40






  • 1





    does not work in GitBash.

    – kyb
    Mar 23 '18 at 9:52












  • 5





    Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

    – Charles Duffy
    Aug 28 '15 at 21:26






  • 2





    Read mywiki.wooledge.org/BashFAQ/050 to grok why.

    – Charles Duffy
    Aug 28 '15 at 21:27











  • this worked for me for a nodejs tool instead of `$cmd`

    – Paulo Oliveira
    Mar 31 '17 at 9:09












  • @PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

    – Charles Duffy
    Apr 29 '17 at 19:40






  • 1





    does not work in GitBash.

    – kyb
    Mar 23 '18 at 9:52







5




5





Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

– Charles Duffy
Aug 28 '15 at 21:26





Works only for extremely simple commands; doesn't work for the one the OP gave in their example.

– Charles Duffy
Aug 28 '15 at 21:26




2




2





Read mywiki.wooledge.org/BashFAQ/050 to grok why.

– Charles Duffy
Aug 28 '15 at 21:27





Read mywiki.wooledge.org/BashFAQ/050 to grok why.

– Charles Duffy
Aug 28 '15 at 21:27













this worked for me for a nodejs tool instead of `$cmd`

– Paulo Oliveira
Mar 31 '17 at 9:09






this worked for me for a nodejs tool instead of `$cmd`

– Paulo Oliveira
Mar 31 '17 at 9:09














@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

– Charles Duffy
Apr 29 '17 at 19:40





@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.

– Charles Duffy
Apr 29 '17 at 19:40




1




1





does not work in GitBash.

– kyb
Mar 23 '18 at 9:52





does not work in GitBash.

– kyb
Mar 23 '18 at 9:52











-3














To eliminate the need for the cmd variable, you can do this:



eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'





share|improve this answer


















  • 3





    If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

    – Charles Duffy
    Aug 28 '15 at 21:26











  • eval with a constant literal makes no sense!

    – Sedat Kilinc
    Jan 1 '17 at 20:59















-3














To eliminate the need for the cmd variable, you can do this:



eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'





share|improve this answer


















  • 3





    If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

    – Charles Duffy
    Aug 28 '15 at 21:26











  • eval with a constant literal makes no sense!

    – Sedat Kilinc
    Jan 1 '17 at 20:59













-3












-3








-3







To eliminate the need for the cmd variable, you can do this:



eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'





share|improve this answer













To eliminate the need for the cmd variable, you can do this:



eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'






share|improve this answer












share|improve this answer



share|improve this answer










answered Jan 27 '15 at 17:15









Paul HavensPaul Havens

131




131







  • 3





    If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

    – Charles Duffy
    Aug 28 '15 at 21:26











  • eval with a constant literal makes no sense!

    – Sedat Kilinc
    Jan 1 '17 at 20:59












  • 3





    If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

    – Charles Duffy
    Aug 28 '15 at 21:26











  • eval with a constant literal makes no sense!

    – Sedat Kilinc
    Jan 1 '17 at 20:59







3




3





If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

– Charles Duffy
Aug 28 '15 at 21:26





If you're just going to have a hardcoded literal, why use eval at all, as opposed to just running mysql [...]?

– Charles Duffy
Aug 28 '15 at 21:26













eval with a constant literal makes no sense!

– Sedat Kilinc
Jan 1 '17 at 20:59





eval with a constant literal makes no sense!

– Sedat Kilinc
Jan 1 '17 at 20:59



Popular posts from this blog

Top Tejano songwriter Luis Silva dead of heart attack at 64

ReactJS Fetched API data displays live - need Data displayed static

政党