I can't give you a code-example because I am not sure what your string retrieved from the databases is like and how the rest of the script looks like...

Best regards,
perl -le "s==*F=e=>y~\*martinF~stronat~=>s~[^\w]~~g=>chop,print"

my $cmd = 'ls -la';
my @out = qx/$cmd/;
[download]

my $hr  = {foo => { bar => '/dev/null' } };

# will not work
my $cmd = 'ls $hr->{foo}->{bar}';
print `$cmd`;

# works a treat
my $cmd = "ls $hr->{foo}->{bar}";
print `$cmd`;

__output__

ls: -: No such file or directory
/dev/null
[download]

broquaint

I think the strings coming back are literals so what I must have is your case 1 which as you say doesn't work ! The literals contain strings that do map to local variables so somehow I've got to translate the part that is the variable to its value ? (I tried splitting it up where the '$' starts but when I set a new variable to: $newcmd=$cmd1.$cmd2; It seems to do the same thing.)

If you do have the unfortunate case of having the string not being interpolated then you could use the string version of eval() to get the desired result.

my $hr  = { foo => { bar => '/dev/null' } };
my $cmd_literal = 'ls $hr->{foo}->{bar}';
my $cmd = eval qq(return "$cmd_literal";);

print `$cmd`;

__output__

/dev/null
[download]

But the best option would be to have $cmd be interpolated rather than resorting to eval().
HTH

broquaint

Hard to say without seeing a little more code... if the problem were tainting, you would get an error message something like:

Insecure dependency in `` while running with -T switch at ping_thingy.
+pl line 10, <STDIN> line 1.
[download]

Backticks interpolate their contents like a double-quoted string... but if you used single-quotes for $cmd, i.e.:

my $cmd = '/usr/sbin/ping $this->{config}->{server}'
my $output = `$cmd`;
[download]

Or better yet, perhaps you can use Net::Ping...

stephen

Be aware that if you're not very sure of the source of the values comming back from your database you're treading in dangerous waters. If a malicious entity can get their own values in there somehow, th3y wI11 0wN J00 (especially since it looks like you're subsequently planning on passing values to system()).

It's better practice to keep your code and data seperate (c.f. use strict "refs" :). Perhaps create different modules implementing an interface, and then use data from your database to select from that (limited, controlled) set of modules.