Shell Programming and Scripting

I suggested set -- as a replacement for putting the command in quotes. It's not a way to put the command in quotes.

What you want is not easy or straightforward for the reasons I already explained. Quotes are not usually a part of strings, quotes denote strings. If you want to give that command to a shell, run it in a shell.

A bourne shell will not evaluate quotes there without an eval, scrutinizer.

If you really wish to kludge it into running like that instead of just running it in the first place, you can feed it into a shell. This is not efficient and probably not the greatest idea.

Code:

echo "$COMMAND" | sh

This may shed some light:

Code:

$ STATEMENT="echo \"hello          there\""
+ STATEMENT='echo "hello          there"'
$ $STATEMENT
+ echo '"hello' 'there"'
"hello there"
$ eval "$STATEMENT"
+ eval 'echo "hello          there"'
++ echo 'hello          there'
hello          there

--
@corona, You are right of course. I jumped in after the last post, because of the the set statement. I had not really read the problem at hand... I'll correct post #7...

This works, but I thought eval was a bad thing? It opens the code up for an Injection attack, right?

Thank you very much for your help!!!!!

Indeed eval is definitely a security risk, you would for example need to make sure that the variable content comes from a controlled source and not from user input or input files or any other source that you do not control or insufficiently control otherwise someone might gain access to the rights of the user executing the script.

So you would need to think if it isn't better to use a different setup that does not require the use of eval. So for example, just do not use the intermediate step of a command variable like $STATEMENT ( I personally never use those ), but execute the command directly without eval. If you do not like that, an alternative could be to create a function.

Yes. So the correct way to prevent this is to not do what you're doing -- not put quotes inside quotes, and have to parse the quotes inside quotes... Store the string in such a way you don't need eval, echo | sh, or other such trickery to parse it. Every alternative we've shown you, you've turned around and tried to store it in a string again, causing the same problems you had before. It's not the way in which you're storing it inside a string that's doing it... It's the fact that you're doing it at all. That doesn't work, no matter how you cut it, without needing to use walking security holes like eval.

Which brings me to the real question. Why do you need to store it in a string like this?

CVS has the ability to store commit messages for each version of a file. These messages tend to be very descriptive and are entered by the user explaining what they did to the file.
So, how would you suggest I get this information from the user as an input and pass it to cvs as a string?

Code:

read MESSAGE

cvs commit -m "${MESSAGE}" ./q.s