Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

In a bash script, how do I sanitize user input?

I'm looking for the best way to take a simple input:

echo -n "Enter a string here: " read -e STRING 

and clean it up by removing non-alphanumeric characters, lower(case), and replacing spaces with underscores.

Does order matter? Is tr the best / only way to go about this?

like image 426
Devin Reams Avatar asked Sep 18 '08 02:09

Devin Reams


People also ask

Should you sanitize user input?

User input should always be treated as malicious before making it down into lower layers of your application. Always handle sanitizing input as soon as possible and should not for any reason be stored in your database before checking for malicious intent.

What does it mean to sanitize user input?

Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and strings to prevent the injection of harmful codes into the system.

How can you collect user's input in a bash script?

If we would like to ask the user for input then we use a command called read. This command takes the input and will save it into a variable.


1 Answers

As dj_segfault points out, the shell can do most of this for you. Looks like you'll have to fall back on something external for lower-casing the string, though. For this you have many options, like the perl one-liners above, etc., but I think tr is probably the simplest.

# first, strip underscores CLEAN=${STRING//_/} # next, replace spaces with underscores CLEAN=${CLEAN// /_} # now, clean out anything that's not alphanumeric or an underscore CLEAN=${CLEAN//[^a-zA-Z0-9_]/} # finally, lowercase with TR CLEAN=`echo -n $CLEAN | tr A-Z a-z` 

The order here is somewhat important. We want to get rid of underscores, plus replace spaces with underscores, so we have to be sure to strip underscores first. By waiting to pass things to tr until the end, we know we have only alphanumeric and underscores, and we can be sure we have no spaces, so we don't have to worry about special characters being interpreted by the shell.

like image 53
Thomee Avatar answered Sep 21 '22 08:09

Thomee