使用printf％q使加引号的字符串可用作外壳脚本输入

Question

Within a bash script, I am trying to append a command string that is single and double quoted to a file ( .profile ).

I would like to use echo and then >> the command to .profile . Of course, I am open to any solution that works.

The command I would like to use is echo "curl -X POST -H "Content-Type: application/json" -d '{"value1":"PHONENUMBER","value2":"MESSAGE"}' https://maker.ifttt.com/trigger/TRIGGER/with/key/KEY &> /dev/null" >> .profile but clearly this doesn't work within my bash script.

I am not clear on how printf %q works and don't understand how to apply it to my problem.

I have tried this

`CMDSTRING='curl -X POST -H "Content-Type: application/json" -d '`
`CMDSTRING=${CMDSTRING}"'"`
`CMDSTRING=${CMDSTRING}'{"value1":"+PHONENUMBER","value2":"MESSAGE"}'`
`CMDSTRING=${CMDSTRING}"'"`
`CMDSTRING=${CMDSTRING}' https://maker.ifttt.com/trigger/TRIGGER/with/key/KEY &> /dev/null'`

`echo $CMDSTRING`

Answer 1

Using printf '%q' to generate .profile content looks something like the following:

{
  printf '%q ' \
    curl -X POST -H "Content-Type: application/json" \
      -d '{"value1":"PHONENUMBER","value2":"MESSAGE"}' \
      https://maker.ifttt.com/trigger/TRIGGER/with/key/KEY
  printf '%s\n' "&>/dev/null" 
} >> .profile

Note that you cannot use the %q format string if you want &>/dev/null to be parsed as syntax, since by its very nature it formats everything it's passed to be parsed as data.

Thus, we use printf '%q ' "command name" "first argument" ... for the actual command itself, and format the redirection out-of-band.

---

That said, note that there's value to the above only if you're substituting variables from an untrusted source (rather than hardcoding them as in the example), and are worried about invalid values being abused for command injection. If you're truly just appending a constant string to the end of a file, a quoted heredoc will let you build more natural-looking shell quoting manually (indeed, as you've already done!), and pass it through verbatim:

cat >>.profile <<'EOF'
curl -X POST -H "Content-Type: application/json" \
  -d '{"value1":"PHONENUMBER","value2":"MESSAGE"}' \
  https://maker.ifttt.com/trigger/TRIGGER/with/key/KEY &> /dev/null
EOF

Here, everything between the <<'EOF' and the EOF are passed through exactly-as-given, including quotes and parameter expansions the shell might otherwise try to interpret.