Hacker News Reader

Comment by habibur | Hacker News Reader

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now.

i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.

View on HN

Because you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.

No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(

It's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.

Writing '...' switches from "writing shell code" to "writing a single-quoted string". It does not switch to "writing arbitrary text" (since that would give us no way to end the string!). You should always convert arbitrary text to "single-quoted string" format: most of the time it will stay the same, e.g. "google.com"; sometimes it needs escaping to prevent benign corruption, e.g. "I'm a little teapot"; in this case it needs escaping to prevent malicious code injection.

That's only because it's got single quotes contained within it.

Syntax highlighting in the shell vaguely helps.

Reply on news.ycombinator.com