Shell Programming and Scripting

If your code is having injection problems wouldn't it also break strings like this Didn't you give him $5 pocket money this week?

It seems like you have some eval, $() or backtick processing against passed strings.

@ Corona: Just to be sure, backticks are ` ~= $(cmd)?
@ Chubler: Not yet, break_on_injections will be my first 'general parsing of input' of passed strings within all (most at least) my tui-commands.

From the perspektive of a local user, i'm not aware of injection problems causing more trouble than the local access to the machine anyway.
The main reason i'm currently at this, is because of a feedback when passing strings from a webpage to some (unnamed) tui-command.
In the combination, i hope to keep up the current functionality, and make it more secure.

What i figured so far, and what Rudic confirmed, was that regular strings (quoted inside "), work as expected, but if using hardcoded strings (quoted inside ') will 'trigger' the break_on_injections.

To my understanding, such strings (when passed from a webpage - which tui was not thought/coded for) would (should?) be passed as hardcoded strings, or get properly escaped before passing the the tui-command, using the 'php escape functions' as proposed on the linked wiki page from the first post.

What i thought of was:
1) Make the function available to all the commands, eg: place it in a file that is source anyway.
2) Call the function before the (string-)arguments are processed any further
3) If 'injections' are found, abort with failure.

Going to try this evening.

Thank you