How to execute a bash command stored as a string with quotes and asterisk [duplicate]
This question already has an answer here:
Why does shell ignore quotes in arguments passed to it through variables? [duplicate]
3 answers
I try to execute the following command :
mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"
I store it in a string :
cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""
Test it :
echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"
Try to execute by doing :
$cmd
And I get the help page of mysql :
mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)
I guess I am doing something plain wrong with the quotes but can't find out what is the problem.
bash scripting escaping quotes
marked as duplicate by tripleee
StackExchange.ready(function()
if (StackExchange.options.isMobile) return;
$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');
$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();
);
);
);
Apr 20 '16 at 11:17
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
|
show 1 more comment
This question already has an answer here:
Why does shell ignore quotes in arguments passed to it through variables? [duplicate]
3 answers
I try to execute the following command :
mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"
I store it in a string :
cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""
Test it :
echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"
Try to execute by doing :
$cmd
And I get the help page of mysql :
mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)
I guess I am doing something plain wrong with the quotes but can't find out what is the problem.
bash scripting escaping quotes
marked as duplicate by tripleee
StackExchange.ready(function()
if (StackExchange.options.isMobile) return;
$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');
$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();
);
);
);
Apr 20 '16 at 11:17
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
9
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
4
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text withdeclare -f
; for an array (the typical "dynamically constructed" approach):printf '%q ' "$array[@]"; echo
.
– Charles Duffy
Aug 28 '15 at 21:25
5
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Usingeval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).
– Charles Duffy
Aug 28 '15 at 21:30
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06
|
show 1 more comment
This question already has an answer here:
Why does shell ignore quotes in arguments passed to it through variables? [duplicate]
3 answers
I try to execute the following command :
mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"
I store it in a string :
cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""
Test it :
echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"
Try to execute by doing :
$cmd
And I get the help page of mysql :
mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)
I guess I am doing something plain wrong with the quotes but can't find out what is the problem.
bash scripting escaping quotes
This question already has an answer here:
Why does shell ignore quotes in arguments passed to it through variables? [duplicate]
3 answers
I try to execute the following command :
mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig"
I store it in a string :
cmd="mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig""
Test it :
echo $cmd
mysql AMORE -u username -ppassword -h localhost -e"SELECT host FROM amoreconfig"
Try to execute by doing :
$cmd
And I get the help page of mysql :
mysql Ver 14.14 Distrib 5.1.31, for pc-linux-gnu (i686) using readline 5.1
Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license
Usage: mysql [OPTIONS] [database]
(...)
I guess I am doing something plain wrong with the quotes but can't find out what is the problem.
This question already has an answer here:
Why does shell ignore quotes in arguments passed to it through variables? [duplicate]
3 answers
bash scripting escaping quotes
bash scripting escaping quotes
edited Feb 14 '13 at 2:25
Stephane Rolland
19.3k2699147
19.3k2699147
asked Jan 5 '10 at 9:55
BarthBarth
6,360135896
6,360135896
marked as duplicate by tripleee
StackExchange.ready(function()
if (StackExchange.options.isMobile) return;
$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');
$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();
);
);
);
Apr 20 '16 at 11:17
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
marked as duplicate by tripleee
StackExchange.ready(function()
if (StackExchange.options.isMobile) return;
$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');
$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();
);
);
);
Apr 20 '16 at 11:17
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
9
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
4
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text withdeclare -f
; for an array (the typical "dynamically constructed" approach):printf '%q ' "$array[@]"; echo
.
– Charles Duffy
Aug 28 '15 at 21:25
5
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Usingeval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).
– Charles Duffy
Aug 28 '15 at 21:30
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06
|
show 1 more comment
9
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
4
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text withdeclare -f
; for an array (the typical "dynamically constructed" approach):printf '%q ' "$array[@]"; echo
.
– Charles Duffy
Aug 28 '15 at 21:25
5
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Usingeval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).
– Charles Duffy
Aug 28 '15 at 21:30
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06
9
9
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
4
4
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with
declare -f
; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo
.– Charles Duffy
Aug 28 '15 at 21:25
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with
declare -f
; for an array (the typical "dynamically constructed" approach): printf '%q ' "$array[@]"; echo
.– Charles Duffy
Aug 28 '15 at 21:25
5
5
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using
eval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).– Charles Duffy
Aug 28 '15 at 21:30
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using
eval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).– Charles Duffy
Aug 28 '15 at 21:30
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06
|
show 1 more comment
5 Answers
5
active
oldest
votes
Have you tried:
eval $cmd
For the follow-on question of how to escape *
since it has special meaning when it's naked or in double quoted strings: use single quotes.
MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"
Bonus: It also reads nice: eval mysql query ;-)
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
...the literal quotes in theeval
statement, when they become syntactic via use ofeval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.
– Charles Duffy
Sep 18 '15 at 19:17
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
@joshmcode, (and yes, that matters here --eval $cmd
, unlikeeval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).
– Charles Duffy
Oct 19 '17 at 18:04
|
show 9 more comments
Use an array, not a string, as given as guidance in BashFAQ #50.
Using a string is extremely bad security practice: Consider the case where password
(or a where clause in the query, or any other component) is user-provided; you don't want to eval
a password containing $(rm -rf .)
!
Just Running A Local Command
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"
Printing Your Command Unambiguously
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'
Running Your Command Over SSH (Method 1: Using Stdin)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"
Running Your Command Over SSH (Method 2: Command Line)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
...that is to say: One can runcmd+=( -e "$query" )
to append those arguments to the existing array, and be assured thatquery
will be added as a single argument to-e
that's passed tomysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.
– Charles Duffy
Aug 30 '15 at 15:31
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
add a comment |
try this
$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
To the extent that it works, this works badly. Needs to beeval "$cmd"
, noteval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.
– Charles Duffy
Feb 3 '16 at 18:34
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
add a comment |
You don't need the "eval" even. Just put a dollar sign in front of the string:
cmd="ls"
$cmd
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
add a comment |
To eliminate the need for the cmd variable, you can do this:
eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
3
If you're just going to have a hardcoded literal, why useeval
at all, as opposed to just runningmysql [...]
?
– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
add a comment |
5 Answers
5
active
oldest
votes
5 Answers
5
active
oldest
votes
active
oldest
votes
active
oldest
votes
Have you tried:
eval $cmd
For the follow-on question of how to escape *
since it has special meaning when it's naked or in double quoted strings: use single quotes.
MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"
Bonus: It also reads nice: eval mysql query ;-)
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
...the literal quotes in theeval
statement, when they become syntactic via use ofeval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.
– Charles Duffy
Sep 18 '15 at 19:17
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
@joshmcode, (and yes, that matters here --eval $cmd
, unlikeeval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).
– Charles Duffy
Oct 19 '17 at 18:04
|
show 9 more comments
Have you tried:
eval $cmd
For the follow-on question of how to escape *
since it has special meaning when it's naked or in double quoted strings: use single quotes.
MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"
Bonus: It also reads nice: eval mysql query ;-)
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
...the literal quotes in theeval
statement, when they become syntactic via use ofeval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.
– Charles Duffy
Sep 18 '15 at 19:17
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
@joshmcode, (and yes, that matters here --eval $cmd
, unlikeeval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).
– Charles Duffy
Oct 19 '17 at 18:04
|
show 9 more comments
Have you tried:
eval $cmd
For the follow-on question of how to escape *
since it has special meaning when it's naked or in double quoted strings: use single quotes.
MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"
Bonus: It also reads nice: eval mysql query ;-)
Have you tried:
eval $cmd
For the follow-on question of how to escape *
since it has special meaning when it's naked or in double quoted strings: use single quotes.
MYSQL='mysql AMORE -u username -ppassword -h localhost -e'
QUERY="SELECT "'*'" FROM amoreconfig" ;# <-- "double"'single'"double"
eval $MYSQL "'$QUERY'"
Bonus: It also reads nice: eval mysql query ;-)
edited Jan 5 '10 at 15:27
answered Jan 5 '10 at 9:57
slebetmanslebetman
67.8k1697123
67.8k1697123
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
...the literal quotes in theeval
statement, when they become syntactic via use ofeval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.
– Charles Duffy
Sep 18 '15 at 19:17
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
@joshmcode, (and yes, that matters here --eval $cmd
, unlikeeval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).
– Charles Duffy
Oct 19 '17 at 18:04
|
show 9 more comments
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
...the literal quotes in theeval
statement, when they become syntactic via use ofeval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.
– Charles Duffy
Sep 18 '15 at 19:17
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
@joshmcode, (and yes, that matters here --eval $cmd
, unlikeeval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).
– Charles Duffy
Oct 19 '17 at 18:04
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
Thanks, it works. How would I select all columns ? How can I escape '*' ?
– Barth
Jan 5 '10 at 10:33
1
1
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
See BashFAQ #48 for discussion of the security pitfalls around this use: mywiki.wooledge.org/BashFAQ/048
– Charles Duffy
Sep 18 '15 at 19:16
1
1
...the literal quotes in the
eval
statement, when they become syntactic via use of eval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.– Charles Duffy
Sep 18 '15 at 19:17
...the literal quotes in the
eval
statement, when they become syntactic via use of eval
, can have their effect undone by any literal quotes within the data; thus, they don't provide effective security.– Charles Duffy
Sep 18 '15 at 19:17
1
1
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
@joshmcode, ...if we want deployed systems running scripts built w/ advice from ServerFault to have injection vulnerabilities. Getting details right matters. The worst data-loss incident I've been present for was when someone didn't use adequate quoting when handling filenames that "couldn't ever" contain anything but hex digits. Until one day one did (due to a bug in a program building the files dumping random memory content into the buffer used as a name), and that script (responsible for pruning ancient backups) deleted months of billing data.
– Charles Duffy
Oct 19 '17 at 18:02
1
1
@joshmcode, (and yes, that matters here --
eval $cmd
, unlike eval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).– Charles Duffy
Oct 19 '17 at 18:04
@joshmcode, (and yes, that matters here --
eval $cmd
, unlike eval "$cmd"
, splits your input into words, evaluates each word as a glob, and then pastes them back together with spaces, so a command with a whitespace-surrounded asterisk in it could cause shell expansions in the current working directory's filenames to be evaluated).– Charles Duffy
Oct 19 '17 at 18:04
|
show 9 more comments
Use an array, not a string, as given as guidance in BashFAQ #50.
Using a string is extremely bad security practice: Consider the case where password
(or a where clause in the query, or any other component) is user-provided; you don't want to eval
a password containing $(rm -rf .)
!
Just Running A Local Command
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"
Printing Your Command Unambiguously
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'
Running Your Command Over SSH (Method 1: Using Stdin)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"
Running Your Command Over SSH (Method 2: Command Line)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
...that is to say: One can runcmd+=( -e "$query" )
to append those arguments to the existing array, and be assured thatquery
will be added as a single argument to-e
that's passed tomysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.
– Charles Duffy
Aug 30 '15 at 15:31
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
add a comment |
Use an array, not a string, as given as guidance in BashFAQ #50.
Using a string is extremely bad security practice: Consider the case where password
(or a where clause in the query, or any other component) is user-provided; you don't want to eval
a password containing $(rm -rf .)
!
Just Running A Local Command
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"
Printing Your Command Unambiguously
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'
Running Your Command Over SSH (Method 1: Using Stdin)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"
Running Your Command Over SSH (Method 2: Command Line)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
...that is to say: One can runcmd+=( -e "$query" )
to append those arguments to the existing array, and be assured thatquery
will be added as a single argument to-e
that's passed tomysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.
– Charles Duffy
Aug 30 '15 at 15:31
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
add a comment |
Use an array, not a string, as given as guidance in BashFAQ #50.
Using a string is extremely bad security practice: Consider the case where password
(or a where clause in the query, or any other component) is user-provided; you don't want to eval
a password containing $(rm -rf .)
!
Just Running A Local Command
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"
Printing Your Command Unambiguously
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'
Running Your Command Over SSH (Method 1: Using Stdin)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"
Running Your Command Over SSH (Method 2: Command Line)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"
Use an array, not a string, as given as guidance in BashFAQ #50.
Using a string is extremely bad security practice: Consider the case where password
(or a where clause in the query, or any other component) is user-provided; you don't want to eval
a password containing $(rm -rf .)
!
Just Running A Local Command
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
"$cmd[@]"
Printing Your Command Unambiguously
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf 'Proposing to run: '
printf '%q ' "$cmd[@]"
printf 'n'
Running Your Command Over SSH (Method 1: Using Stdin)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host 'bash -s' <<<"$cmd_str"
Running Your Command Over SSH (Method 2: Command Line)
cmd=( mysql AMORE -u username -ppassword -h localhost -e "SELECT host FROM amoreconfig" )
printf -v cmd_str '%q ' "$cmd[@]"
ssh other_host "bash -c $cmd_str"
edited Apr 6 '18 at 17:18
answered Aug 28 '15 at 21:34
Charles DuffyCharles Duffy
178k25200254
178k25200254
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
...that is to say: One can runcmd+=( -e "$query" )
to append those arguments to the existing array, and be assured thatquery
will be added as a single argument to-e
that's passed tomysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.
– Charles Duffy
Aug 30 '15 at 15:31
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
add a comment |
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
...that is to say: One can runcmd+=( -e "$query" )
to append those arguments to the existing array, and be assured thatquery
will be added as a single argument to-e
that's passed tomysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.
– Charles Duffy
Aug 30 '15 at 15:31
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
3
3
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
Consider the case where no passwords are in the query. Think how useful it would be.
– David Beckwith
Aug 30 '15 at 6:55
4
4
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
@DavidBeckwith, why is the approach with security vulnerabilities more useful than the one without? What benefit does it add? You can still dynamically construct your arrays; you just get the benefit of not risking their contents being parsed in a manner different from that intended.
– Charles Duffy
Aug 30 '15 at 15:24
3
3
...that is to say: One can run
cmd+=( -e "$query" )
to append those arguments to the existing array, and be assured that query
will be added as a single argument to -e
that's passed to mysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.– Charles Duffy
Aug 30 '15 at 15:31
...that is to say: One can run
cmd+=( -e "$query" )
to append those arguments to the existing array, and be assured that query
will be added as a single argument to -e
that's passed to mysql
; no need to look into its contents to figure out if it spawns a subshell or escapes its quotes and launches a rootkit or whatever else.– Charles Duffy
Aug 30 '15 at 15:31
9
9
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
It's more exciting if you have security vulnerabilities.
– David Beckwith
Aug 31 '15 at 8:59
4
4
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
I... really don't know what I can say in response to that. Other than "please don't apply to work with me". Or, maybe, "please don't apply to work anywhere making products I use".
– Charles Duffy
Mar 28 '17 at 16:09
add a comment |
try this
$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
To the extent that it works, this works badly. Needs to beeval "$cmd"
, noteval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.
– Charles Duffy
Feb 3 '16 at 18:34
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
add a comment |
try this
$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
To the extent that it works, this works badly. Needs to beeval "$cmd"
, noteval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.
– Charles Duffy
Feb 3 '16 at 18:34
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
add a comment |
try this
$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd
try this
$ cmd='mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
$ eval $cmd
answered Jan 5 '10 at 10:03
ghostdog74ghostdog74
221k41211302
221k41211302
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
To the extent that it works, this works badly. Needs to beeval "$cmd"
, noteval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.
– Charles Duffy
Feb 3 '16 at 18:34
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
add a comment |
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
To the extent that it works, this works badly. Needs to beeval "$cmd"
, noteval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.
– Charles Duffy
Feb 3 '16 at 18:34
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
1
1
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
thanks, it works. I marked the other answer as the accepted one because it came before.
– Barth
Jan 5 '10 at 10:32
4
4
To the extent that it works, this works badly. Needs to be
eval "$cmd"
, not eval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.– Charles Duffy
Feb 3 '16 at 18:34
To the extent that it works, this works badly. Needs to be
eval "$cmd"
, not eval $cmd
, to handle cases where any word-split component could be glob-expanded to a file in the current directory -- or cases where characters in IFS can't be substituted for others harmlessly.– Charles Duffy
Feb 3 '16 at 18:34
4
4
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
This solution risks a command injection security vulnerability if any of the input to the eval'ed string is user-supplied. The solution that @CharlesDuffy provides is much better.
– jsears
Feb 25 '16 at 16:23
add a comment |
You don't need the "eval" even. Just put a dollar sign in front of the string:
cmd="ls"
$cmd
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
add a comment |
You don't need the "eval" even. Just put a dollar sign in front of the string:
cmd="ls"
$cmd
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
add a comment |
You don't need the "eval" even. Just put a dollar sign in front of the string:
cmd="ls"
$cmd
You don't need the "eval" even. Just put a dollar sign in front of the string:
cmd="ls"
$cmd
answered Aug 28 '15 at 21:22
David BeckwithDavid Beckwith
1,495107
1,495107
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
add a comment |
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
5
5
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
Works only for extremely simple commands; doesn't work for the one the OP gave in their example.
– Charles Duffy
Aug 28 '15 at 21:26
2
2
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
Read mywiki.wooledge.org/BashFAQ/050 to grok why.
– Charles Duffy
Aug 28 '15 at 21:27
this worked for me for a nodejs tool instead of
`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
this worked for me for a nodejs tool instead of
`$cmd`
– Paulo Oliveira
Mar 31 '17 at 9:09
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
@PauloOliveira, that's because what you were trying before was trying to capture the output of your command, break that output into words, and run those words as another command itself.
– Charles Duffy
Apr 29 '17 at 19:40
1
1
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
does not work in GitBash.
– kyb
Mar 23 '18 at 9:52
add a comment |
To eliminate the need for the cmd variable, you can do this:
eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
3
If you're just going to have a hardcoded literal, why useeval
at all, as opposed to just runningmysql [...]
?
– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
add a comment |
To eliminate the need for the cmd variable, you can do this:
eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
3
If you're just going to have a hardcoded literal, why useeval
at all, as opposed to just runningmysql [...]
?
– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
add a comment |
To eliminate the need for the cmd variable, you can do this:
eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
To eliminate the need for the cmd variable, you can do this:
eval 'mysql AMORE -u root --password="password" -h localhost -e "select host from amoreconfig"'
answered Jan 27 '15 at 17:15
Paul HavensPaul Havens
131
131
3
If you're just going to have a hardcoded literal, why useeval
at all, as opposed to just runningmysql [...]
?
– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
add a comment |
3
If you're just going to have a hardcoded literal, why useeval
at all, as opposed to just runningmysql [...]
?
– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
3
3
If you're just going to have a hardcoded literal, why use
eval
at all, as opposed to just running mysql [...]
?– Charles Duffy
Aug 28 '15 at 21:26
If you're just going to have a hardcoded literal, why use
eval
at all, as opposed to just running mysql [...]
?– Charles Duffy
Aug 28 '15 at 21:26
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
eval with a constant literal makes no sense!
– Sedat Kilinc
Jan 1 '17 at 20:59
add a comment |
9
I recommend that you read this: mywiki.wooledge.org/BashFAQ/050
– Dennis Williamson
Jan 5 '10 at 11:43
4
@DennisWilliamson - top link; I especially like this: "If your head is SO far up your ass that you still think you need to write out every command you're about to run before you run it" - I wonder, how the author of that, would solve a script where you construct a command dynamically, and explicitly want to echo it - in order to prompt the user "Do you want to run this command?" before it's ran?...
– sdaau
May 30 '13 at 20:26
@sdaau, depends on which of the approaches given in the FAQ is being used. For a function, one can print its text with
declare -f
; for an array (the typical "dynamically constructed" approach):printf '%q ' "$array[@]"; echo
.– Charles Duffy
Aug 28 '15 at 21:25
5
The best-practices approach, by the way, is not to store your command as a string. If you want to dynamically construct it, do so with an array. Using
eval
, as the top answers here do, incurs substantial security risk (opening one up to shell injection attacks if any content is parameterized).– Charles Duffy
Aug 28 '15 at 21:30
@DennisWilliamson -- i like doing if for a --dryrun feature in [big] shell that has multiple phases and the user might skip around. Make sense??
– mobibob
Oct 9 '18 at 20:06