50

I've the following bash script to upgrade my database schema. Script reads hostname and database password from command line.

The problem is here that if the password is alphanumeric e.g r00t then script works. But if password contains special characters e.g pa**w0rd, then script does not work and directly exits. Please help me with this. Thanks.

#!/bin/bash

echo "Enter hostname."
read -p "Hostname [localhost]: " DB_HOST
DB_HOST=${DB_HOST:-localhost}

echo "Enter MySQL root password"
DB_PASS=
while [[ $DB_PASS = "" ]]; do
   read -sp "Password: " DB_PASS
done

MYSQL="mysql --force --connect-timeout=90 --host=$DB_HOST -u root --password=${DB_PASS}"

# Apply schema updates. My DBName is "mydb"
# Upgrade schema file is stored in "mysql" folder

$MYSQL mydb -e exit > /dev/null 2>&1 && $MYSQL mydb < "../mysql/upgrade_schema_v.2.1.sql"
3
  • Change the password to use only characters you know work. For security you should then make the password longer.
    – Ben
    Commented Oct 10, 2017 at 9:54
  • The problem seems really to be that you're trying to store the command to run as a string. Please see mywiki.wooledge.org/BashFAQ/050, to avoid code repetition it would be better to use a function here instead of a string that you have trouble quoting correctly. Commented Oct 10, 2017 at 10:37
  • 1
    I suggest put backslash on every character, i.e., -p\t\h\i\s\i\s\p\a\s\s\w\o\r\d
    – Autodesk
    Commented Jun 10, 2019 at 5:45

4 Answers 4

61

Logging into mysql using bash

For ubuntu or linux shell try to use command

mysql -u username -p'p@ssw()rD'

for remote host login use

mysql -h hostname -u user -p'password'
3
  • 1
    For myself in the future, not there's no space after the -p even though there is for the username
    – doctorlove
    Commented Jul 16, 2021 at 14:00
  • correct, In the answer also @doctorlove there is no space Commented Jul 22, 2021 at 7:29
  • No single quotes either Commented Apr 24 at 17:39
26

This is occurring because you are using shell GLOB (wildcard) characters in the password, and in Bash (or on Linux generally) wildcards are expanded by the shell.

The safest and most reliable solution is to not use shell wildcard characters or other characters interpreted by the shell in the password. You should also avoid spaces. There are plenty of other characters.

Here are the ones you should avoid:

" ' $ , [ ] * ? { } ~ # % \ < > | ^ ;

Here are the ones it is usually safe to use:

: @ . , / + - ! =

To ensure the password is still secure, make it longer. As an example:

K@3amvv7l1wz1192sjqhym

This meets old-fashioned password complexity rules, because upper, lower, numbers and special characters are in the first four, the remainder is randomly generated but avoids any problematic characters.

However if you must use them, you can quote the password parameter with single quotes - though you will still run in to trouble if the password contains single quotes!

6
  • 2
    Thanks for the answer. But I need to make the script to accept those characters, because there are customers who are already using the password with those characters.
    – techsu
    Commented Oct 10, 2017 at 10:20
  • 4
    while the ; is safe to use in a password, if you're scripting in bash you'll need to escape it with a forward slash \
    – anon
    Commented May 1, 2018 at 20:55
  • This was very useful and solved issues with not logging in when using options files. Commented Nov 12, 2020 at 6:15
  • if the user used the following chars as you mentioned: " ' $ , [ ] * ? { } ~ # % \ < > | ^ ; Would this be vulnerable to OS command injection ?
    – str028
    Commented Jan 22 at 14:54
  • Yes or no depending. If the password is properly quoted, then any character may be safely used, including the ones I advise against. ... however they are often not properly quoted, and may be used by shellscripts which might be written later. My advice is to use characters which are safe whether they are properly quoted or not.
    – Ben
    Commented Jan 22 at 18:28
5

Try enclosing your password in single quotes.

If it's pa**w0rd, use 'pa**w0rd'

1
  • But I'm reading the password from command line, please tell me how will I quote it? Thanks
    – techsu
    Commented Oct 10, 2017 at 10:18
2

Variables are best used for data, not code. The layers of variables make it hard to protect the expansion when you want some parts of the expansion (i.e., you want your command line to be word split on the tokens you want), but don't want all the other effects. The solution is to not store the code in a string. Instead, use a function like:

do_mysql() {
    host="$1"
    pass="$2"
    mysql --force --connect-timeout=90 --host="$host" -u root --password="$pass" "$@"
}

then you can run it with extra arguments like

do_mysql "$DB_HOST" "$DB_PASS" -e exit > /dev/null && do_mysql "$DB_HOST" "$DB_PASS" < "../mysql/upgrade_schema_v.2.1.sql"

Though it would also be better not to use upper case for your variables. Doing so makes it so you could collide with environment variables and accidentally change things you don't intend to change (as the number of people who accidentally reset PATH can attest).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.