Bash echo with an $ character outside the string

Question

Can anyone explain what is the difference between

echo $"Starting $CMD" 

and

echo "String $CMD"

They seem to look the same.

Answer 1

Look up the QUOTING section of the bash man page:

Words of the form $'string' are treated specially. The word expands to string, with backslash- escaped characters replaced as specified by the ANSI C standard. Backslash escape sequences, if present, are decoded as follows:

• \a alert (bell)
• \b backspace
• \e an escape character
• \f form feed
• \n new line
• \r carriage return
• \t horizontal tab
• \v vertical tab
• \ backslash
• \' single quote
• \nnn the eight-bit character whose value is the octal value nnn (one to three digits)
• \xHH the eight-bit character whose value is the hexadecimal value HH (one or two hex digits)
• \cx a control-x character

The expanded result is single-quoted, as if the dollar sign had not been present.

And note the follow description double quoted strings preceded by $ ($"string"):

A double-quoted string preceded by a dollar sign ($) will cause the string to be translated according to the current locale. If the current locale is C or POSIX, the dollar sign is ignored. If the string is translated and replaced, the replacement is double-quoted.

Answer 2

$"" is a form of quoting that is used for language translation. If you invoke bash with the -D flag it will print out all such strings. When the locale is C or POSIX, this form of quotation doesn't do anything.

These strings are used by gettext to look up appropriate translations. For example, if your script has the string $"Hello, World" and you have properly installed MO files for translating that string into, say, French, you could execute your script this way:

LANGUAGE=fr_FR ./yourscript

and expect all instances of $"Hello, World" to be output as Bonjour, Tout le Monde (assuming that is what is actually in your translation file).

Translation is not magic or automatic, so you must provide the translation engine with whatever translation strings it doesn't already have.

(PS - the guide I linked to does mention this security bug, but you may miss it if you skim, so I highlight it again here.)