Re: The question hpunixguy2 was too scared to ask - How does he quote shell meta characters

Don’t escape particular characters. Protect any single quotes found in the data and then surround the whole string with single quotes, instead.

while ( <DATA> ) {
    chomp;
    s/'/'\\''/g;
    print "'$_'\n";
}
[download]

That is so simple you cannot get it wrong.

Makeshifts last the longest.

Comment on Re: The question hpunixguy2 was too scared to ask - How does he quote shell meta characters Download Code

Replies are listed 'Best First'.
Re^2: The question hpunixguy2 was too scared to ask - How does he quote shell meta characters (simple) by tye (Sage) on Mar 12, 2006 at 07:27 UTC
I find `qq("\Q$x\E")` much simpler. And even just `"\Q$x\E"` handles everything but newline and nul. - tye	[reply] [d/l] [select]
Re^3: The question hpunixguy2 was too scared to ask - How does he quote shell meta characters (too simple) by Aristotle (Chancellor) on Mar 12, 2006 at 19:49 UTC
Unfortunately, they’re both wrong. quotemeta is not a shell-quoting function, so the escaping agrees largely, but not entirely, which means the code is still unsafe. The second example, as you noted, will get newlines wrong. The first one gets lots of things wrong: `$ echo '{}' {} $ echo "\{\}" \{\} $ echo "\\\\{\\\\}" \{\} $ echo "\\\\\{\\\\\}" \\{\\}` [download] With a bit of effort, you can use the discrepance in the last two demonstrations to cancel backslashes added by quotemeta. It’s tricky to exploit such an over-escaping vulnerability, but it’s entirely doable. In contradistinction, quoting shell strings by protecting single quotes and then single-quoting the entire string is absolutely airtight. The PHP folks had to learn the same lesson when it came to using addslashes to quote strings interpolated into SQL. Since none of the databases use the exact same quoting rules as PHP, SQL injection is still possible when quoting is done that way. It takes effort to exploit the weakness, but attackers will go to that length; so now PHP has a bunch of database-specific quoting functions. Makeshifts last the longest.	[reply] [d/l]
Re^4: The question hpunixguy2 was too scared to ask - How does he quote shell meta characters (too simple) by tye (Sage) on Mar 12, 2006 at 21:21 UTC
Perl's relative sanity (and consistency) when it comes to quoting has lead to me forget many of the stupidities (or inconsistencies) of /bin/sh quoting. The fact that \ is often preserved inside of double quotes is a problem that I haven't had to deal with recently. Thanks for pointing these out. - tye	[reply]