I was taught horrible bad practice when I initially "learned" SQL, which baked in user-submitted input with quotes and attempted to "escape" this (in the beginning, I didn’t even escape it at all…). I then had to spend many years unlearning this, to instead do things like:
SELECT * FROM table WHERE id = $ 1;
And then the
$ 1‘s data is sent separately to the database, not part of the actual query string, to make it impossible for "SQL injections" to happen.
However, terminal commands frequently need to be sent untrusted user input, such as:
generate_PDF.exe --template="a path goes here" --title-of-report="arbitrary title from user"
Every time I have to run such a command, I’m scared to death that my "terminal argument escape" function isn’t working correctly, or has some unknown bug, so that users can make a title along the lines of
"; rm -rf /; to execute arbitrary code on my machine.
This becomes even more of a serious issue when the normal "OS quotes" cannot be used, such as:
pg_dump --format custom --file "a real path" --exclude-table="schema name"."table name"
"schema name"."table name" part has to be provided in full from the user, and thus I have to attempt to verify the syntax myself, as it cannot just be quoted in its entirety with the "terminal argument escaper" function wrapping it all. (Even if it might be possible in this specific context, I’m talking in general and just using this as an example of when it gets "hairy".)
This has made me wonder why the terminal commands, for example in PHP (since I use this myself for everything) cannot be done like this:
pg_dump --format custom --file $ 1 --exclude-table=$ 2
And then we send the actual arguments separately as an array of strings, just like with the "parameterized queries" in SQL databases?
Please note that the
$ 1 and
$ 2 here do not refer to PHP variables, but to "placeholders" for the "engine" which interprets this and which lives either in PHP or the OS.
Why is this not a thing? Or maybe it is, only I haven’t heard of it? I’m continuously baffled by how many things which I constantly need and use just "sit there and rot" while they keep releasing a new programming language every week which nobody uses. I feel more and more frustrated about how "stale" everything I care about seems, but this risks getting off-topic, so I’ll stick to the question I’ve just asked for now.