CODEWITHSUNDEEP
linuxbashpostgresqlshellcgi
Аноним
Аноним

Reputation: 13

Variable within a variable in a CGI script

There is such a script:

NAME = `echo "$QUERY_STRING" | sed -n 's/^.*post=\([^&]*\).*$/\1/p' | sed "s/%20/ /g"`
RES = `psql -U user -d db -t -c "SELECT tabl FROM tablica WHERE name = '$NAME'"`
echo $RES

Everything works fine (it means GET requests are fine). But the data from the database do not go.

The problem is that the value of the parameter in the query WHERE NAME is not being set, and I get a syntax error.

I have read many articles on the Internet, but found nothing about a variable inside backticks.

How can I fix this?

Upvotes: 1

Views: 51

Answers (1)

Mat
Mat

Reputation: 206689

You're not allowed to put spaces around the equal sign in variable assignments. And you should generally not use backticks, but prefer the $() form, it is easier to deal with quoting with it.

NAME=$(echo "$QUERY_STRING" | sed -n 's/^.*post=\([^&]*\).*$/\1/p' | sed "s/%20/ /g")
RES=$(psql -U user -d db -t -c "SELECT tabl FROM tablica WHERE name = '$NAME'")
echo "$RES"

Note that what you're doing is pretty insecure, you need stronger validation for your inputs.

Upvotes: 2

Related Questions