Expansion of variables inside single quotes in a command in Bash

by

Inside single quotes everything is preserved literally, without exception.

That means you have to close the quotes, insert something, and then re-enter again.

'before'"$variable"'after'
'before'"'"'after'
'before'\''after'

Word concatenation is simply done by juxtaposition. As you can verify, each of the above lines is a single word to the shell. Quotes (single or double quotes, depending on the situation) don’t isolate words. They are only used to disable interpretation of various special characters, like whitespace, $, ;… For a good tutorial on quoting see Mark Reed’s answer. Also relevant: Which characters need to be escaped in bash?

Do not concatenate strings interpreted by a shell

You should absolutely avoid building shell commands by concatenating variables. This is a bad idea similar to concatenation of SQL fragments (SQL injection!).

Usually it is possible to have placeholders in the command, and to supply the command together with variables so that the callee can receive them from the invocation arguments list.

For example, the following is very unsafe. DON’T DO THIS

script="echo \"Argument 1 is: $myvar\""
/bin/sh -c "$script"

If the contents of $myvar is untrusted, here is an exploit:

myvar="foo"; echo "you were hacked"

Instead of the above invocation, use positional arguments. The following invocation is better — it’s not exploitable:

script="echo "arg 1 is: $1""
/bin/sh -c "$script" -- "$myvar"

Note the use of single ticks in the assignment to script, which means that it’s taken literally, without variable expansion or any other form of interpretation.

More Related Contents:

  1. Difference between single and double quotes in Bash
  2. How to check if a variable is set in Bash
  3. How to store standard error in a variable
  4. Variable containing multiple args with quotes in Bash
  5. What is the difference between ${var}, “$var”, and “${var}” in the Bash shell?
  6. What is the exact meaning of IFS=$’\n’?
  7. How to split one string into multiple variables in bash shell? [duplicate]
  8. How to substitute quoted, multi-word strings as arguments?
  9. Using a variable’s value as password for scp, ssh etc. instead of prompting for user input every time
  10. What does 2>&1 mean here?
  11. Input data to a shell script [closed]
  12. How to reload .bashrc settings without logging out and back in again?
  13. How do I iterate over a range of numbers defined by variables in Bash?
  14. What is the purpose of the : (colon) GNU Bash builtin?
  15. Multi-dimensional arrays in Bash
  16. How do I check if a directory exists in a Bash shell script?
  17. Checking from shell script if a directory contains files
  18. Escape dollar sign in string by shell script
  19. How to list variables declared in script in bash?
  20. Piping tail output though grep twice
  21. bash set -e and i=0;let i++ do not agree
  22. How to go to each directory and execute a command?
  23. Relative paths based on file location instead of current working directory [duplicate]
  24. Counting lines or enumerating line numbers so I can loop over them – why is this an anti-pattern?
  25. pipe stdout and stderr to two different processes in shell script?
  26. Why equal to operator does not work if it is not surrounded by space?
  27. In bash, is there an equivalent of die “error msg”
  28. How do I integrate MSYS2 shell into Visual studio code on Window?
  29. Use GNU find to show only the leaf directories
  30. Get the name of the caller script in bash script

Leave a Comment