I have a script which takes user input and does a lot of things. One thing which I am worried about is it takes a file name and removes that file. e.g. rm -rf $arg1.

A user could technically input / in this arg and break things. How do I make it so I escape all symbols (my requirement is just letters and numbers as everything happens in one dir) before I actually execute the rm command.

I have come up with an echo "$name" | grep -v symbols > $newname

I'm not sure if this is a good way of doing it. What are your suggestions on this.

  1. Check with grep (for / and *):

    if echo "$user_cmd" | grep '*\|\/'; then
  2. BUT.... you should probably treat this as a permissions issue instead. Assign users who use the script to a group with locked-down permissions. This would be better than just stripping characters as a period (.) could be used for both a file extension (.JPG ) and ../../

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.