Behavior of parameter expansion

Question

I always thought that with a parameter expansion such as $foo, the shell replaces $foo with the contents of the parameter before executing the command. If, for example, I set

foo='`'

Why then, does

ls $foo

have different behavior than

ls `

?

Answer 1

bash has several distinct phases in the processing of a command line. Relevant here are the parsing phase and the expansion phase. The phases occur in order, and one phase does not begin until the previous phase completes.

In the first example, the parser never sees the backquote; that is supplied by the expansion of $foo which occurs after parsing is complete. As a result, a literal backquote is passed to ls as an argument.

In the second example, the parser sees an unquoted backquote, which indicates the beginning of a command substitution.