UNIX for Dummies Questions & Answers

Hi Gary,

Your Method worked. Thanks a ton for your help.

Thanks
Sandeep

I was thinking about this during lunch and realized this is very dangerous though. The way it is written right now, with eval working on user input with no validation, it would execute a command passed to it. You need to be careful and add validation to allow only one of a known list of variables to be entered. Or look for a different way to accomplish the same thing. Try this to see for yourself:

Code:

$ x
***************************************
Please Enter Variable Name :
`ls -lar`
$total 8 -rwxrwx--x 1 user1 zx 233 Apr 27 09:13 x drwxr-xr-x 21 user1 zx 2048 Apr 23 16:02 .. drwxrwx--- 2 user1 1024 Apr 25 10:37 .
$

Someone devious could wreak havoc!

In this case, devious.sh just runs a shell script that does a query to the database, but you see how this could be very dangerous:

Code:

x
***************************************
Please Enter Variable Name :
`devious.sh`
$ SYSDATE ----------- 27-APR-2012
$

It would be safer to assign the values to an associative array making eval unnecessary and allowing for fairly simple verification of a valid name entered.

Code:

#!/usr/bin/env ksh

function prompt
{
    read vname?"Enter a variable name: "
    return 0
}

typeset -A paths
paths[dir]=/tmp/dir
paths[bar]=/tmp/bar
paths[foo]=/tmp/foo

while prompt
do
    if [[ -z $vname ]]
    then
        exit
    fi

    if [[ -z ${paths[$vname]} ]]
    then
        echo "not a valid variable name: $vname"
    else
        echo "the path associated with $vname is: ${paths[$vname]}"
    fi
done