MIME-Version: 1.0
References: 
 <DM8PR09MB6677729E8FC7452DAAD053E5B83AA@DM8PR09MB6677.namprd09.prod.outlook.com>
 <CANzqJaBC5rx0fNbmx1bom9ZE3v1UgQxH3uXWOFHCfUb=rkqcEQ@mail.gmail.com>
 <2343915.1756494912@sss.pgh.pa.us>
In-Reply-To: <2343915.1756494912@sss.pgh.pa.us>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Fri, 29 Aug 2025 17:15:44 -0400
Message-ID: 
 <CANzqJaCuEFz19dTB53iwiW0vDp1yHrkX8P_1bSyKPyoL8vQ+GQ@mail.gmail.com>
Subject: Re: Having trouble passing a shell variable to a query from psql
 command line
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000fce2b0063d8786cb"
Archived-At: 
 <https://www.postgresql.org/message-id/CANzqJaCuEFz19dTB53iwiW0vDp1yHrkX8P_1bSyKPyoL8vQ%2BGQ%40mail.gmail.com>
Precedence: bulk

--000000000000fce2b0063d8786cb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Aug 29, 2025 at 3:15=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote:

> Ron Johnson <ronljohnsonjr@gmail.com> writes:
> > Yeah.  From the cli KISS and do regular bash variable string expansion.
>
> > psql -d mydb -tAc "SELECT relkind FROM pg_class WHERE relname =3D
> > ${SHELL_VAR} ;"
>
> This isn't a great recommendation because bash is not aware of
> SQL's quoting rules.  It'll work in simple cases, but there's
> a risk of SQL injection if the value of SHELL_VAR comes from
> an untrustworthy source.


Well, yeah, if your shell script interacts with the outside world you've
got to be a bit more robust than if the script only does db maintenance
operations on the db server.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000fce2b0063d8786cb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Aug 29, 2025 at 3:15=E2=80=AFPM T=
om Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.us">tgl@sss.pgh.pa.us</a>&gt; =
wrote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">Ron Johnson &lt;<a href=3D"mailto:ronlj=
ohnsonjr@gmail.com" target=3D"_blank">ronljohnsonjr@gmail.com</a>&gt; write=
s:<br>
&gt; Yeah.=C2=A0 From the cli KISS and do regular bash variable string expa=
nsion.<br>
<br>
&gt; psql -d mydb -tAc &quot;SELECT relkind FROM pg_class WHERE relname =3D=
<br>
&gt; ${SHELL_VAR} ;&quot;<br>
<br>
This isn&#39;t a great recommendation because bash is not aware of<br>
SQL&#39;s quoting rules.=C2=A0 It&#39;ll work in simple cases, but there=
9;s<br>
a risk of SQL injection if the value of SHELL_VAR comes from<br>
an untrustworthy source.</blockquote><div><br></div><div>Well, yeah, if you=
r shell script interacts with the outside world you&#39;ve got to be a bit =
more robust than if the script only does db maintenance operations on the d=
b server.=C2=A0</div></div><div><br></div><span class=3D"gmail_signature_pr=
efix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"=
ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boil me, I&=
#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></div></div>=
</div></div></div>

--000000000000fce2b0063d8786cb--