Your comments are fair, but in common use cases appropriate quoting of the shell command line is sufficient, especially if one can control the contents of the password and filename. If these come from arbitrary user input, then your approach is more reasonable.

I'm not sure what you mean. I can guess you'd mean one of these.

• Store the shell literal in the config.

  my $password = '...';  # Not the password, but a shell literal of the 
  +password.
  system( ... "-p$password" ... );
  [download]

• Pretend the config is a shell literal.

  my $password = '...';
  system( ... "-p$password" ... );  # Pretend $password is a shell liter
  +al.
  [download]

• Embed the config data in the command

  system( ... "-p..." ... );
  [download]

Every one of these are very unappealing to me.

The only issue that cannot be resolved by single quoting relevant parts of the command line is of escaping single quotes. Either do this manually, or do something simple like this:

s#'#'\\''#g for ($password, $path);
system("mysqldump --add-drop-table -uroot -p'$password' mydatabase | g
+zip -9c > '$path'");
[download]

Update: s/// command corrected as per ikegami.