I'm trying to clean up a database while running some tests in a bash script, and the following attempt at line continuation is not working:
mysql -e "DELETE FROM test.users WHERE username ="\
"'<a href=https://localhost>XSS Hack!</a>';"
I get the error
ERROR 1044 (42000): Access denied for user 'web'#'localhost' to database ''<a href=https://localhost>XSS Hack!</a>';'
The command works fine if I run it on a single line.
The backslash escapes the newline, but the whitespace at the beginning of the next line still acts as a word delimiter. So the command becomes equivalent to:
mysql -e "DELETE FROM test.users WHERE username =" "'<a href=https://localhost>XSS Hack!</a>';"
If you end a line in the middle of a string, you don't need to escape the newline. MySQL doesn't mind newlines in queries, either. So you can simply write:
mysql -e "DELETE FROM test.users WHERE username =
'<a href=https://localhost>XSS Hack!</a>';"
Related
I am trying to execute a mysql command inside a bash script but every time I try to execute it fails for some reason. I have tried several ways and none seemed to work(e.g: <<QUERY...;QUERY)
My select is the following but I get an error:
#!/bin/bash
mysql -utesting -pMypass -hlocalhost -D test DB -e "
SELECT value FROM h6_options
where module=cloud
AND `option`=prefix;"
I get the following error.
ERROR 1064 (42000) at line 3: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '='prefix'' at line 5
Any help is appreciated.
You are using a multi-line SQL statement. this means you have two options:
you can push everything into one single line.
try reformatting your script to use EOF tags instead.
any option I didn't think of that the smart people here can consider...
here's an example:
mysql -u USER -pPASSWORD <<EOF
SQL_QUERY 1
SQL_QUERY 2
SQL_QUERY N
EOF
so for you, I would do this:
mysql -utesting -pMypass -hlocalhost -D test DB <<EOF
SELECT value FROM h6_options
where module=cloud
AND `option`='prefix';
EOF
Note: I don't like using the word EOF....for me, I like the word SQL or QUERY. because EOF means end of file. The code is identical, so you can use the word of choice:
mysql -utesting -pMypass -hlocalhost -D test DB <<QUERY
SELECT `value` FROM `h6_options`
where `module`='cloud'
AND `option`='prefix';
QUERY
Source: https://www.shellhacks.com/mysql-run-query-bash-script-linux-command-line/
Turns out the issue was the backticks. I had to escape them in order to not evaluate the line.
<<QUERY
SELECT value FROM h6_options
WHERE \`option\`="prefix"
AND module="cloud"
QUERY
This question already has answers here:
Pass parameter to MySQL script command line
(4 answers)
Closed 2 years ago.
When I execute a MySQL query from the shell script using value as variable, it shows
ERROR 1064 (42000) at line 1: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '#gmail.com' at line 1
my code
#!/bin/bash
email='new_user#gmail.com'
# Checking - is the email already exists,
email_exists=$(mysql -u username -ppassword -e "SELECT id FROM db.user where email=$email;")
no problem when using inline (without using a variable).
FYI: I am using email as a variable because I need to reuse somewhere in code.
Add single quotes around the string (inside your existing double quotes) to make it valid SQL:
email_exists=$(mysql -u username -ppassword -e "SELECT id FROM db.user where email='$email';")
That said, note that this is only safe at all when you control the string and are certain it doesn't contain any literal quotes inside its content. (new_user#gmail.com is safe, but new_user#gmail.com'; DROP TABLE db; -- ' would not be). Bill Kelwin's answer on "Injection proof SQL statements from command line" provides one way to avoid this pitfall.
Single-quotes and double-quotes are used in bash to escape certain characters, they are not used to signal a string. The single-quotes in your case will not be used in your mysql statement, therefore you get a syntax error (you don't have a string your mysql statement).
#!/bin/bash
email=new_user#gmail.com
# Checking - is the email already exists,
email_exists=$(mysql -u username -ppassword -e "SELECT id FROM db.user where email='$email';")
I am trying to export my sql table data to csv but have these errors. I am really confused with double quotes and single quotes.
#!/bin/bash
mysql -u root -pH0tjava1 -B -e 'SELECT CONCAT("sshpass -p ""Password"" rsync -avvtzh -e ""ssh -o StrictHostKeyChecking=no"" --log-file=""/home/toor/rsync2.log""", login,"#", ftp_addr, " :", camera_name,"/", "/",`\ 'home`',"/",login, "/", camera_name) INTO OUTFILE '/tmp/rsynctest3.csv' lines terminated by '\r\n' from inteliviz.cameras;"
Errors:
/usr/local/bin/rsync.sh: line 8: syntax error near unexpected token `)'
/usr/local/bin/rsync.sh: line 8: ` mysql -u root -pH0tjava1 -B -e "select CONCAT ("sshpass -p "Pa55word" rsync -avvtzh -e "ssh -o StrictHostKeyChecking=no" --log-file= "/home/toor/rsync2.log", login,camera_name,ftp_addr) INTO OUTFILE '/tmp/rsynctest3.csv' lines terminated by '\r\n' from inteliviz.cameras;"'
/usr/local/bin/rsync.sh: line 8: unexpected EOF while looking for matching ``'
/usr/local/bin/rsync.sh: line 11: syntax error: unexpected end of file
I am really confused with double quotes and single quotes.
You have not only double and single quotes, but also backticks in your statement. The mismatches are:
You begin the SQL statement with 'SELECT… and end it with …inteliviz.cameras;". To switch the quotes from ' in the first part to " in the last part, you must insert a closing ' and an opening " betwixt, e. g. …camera_name)'" INTO OUTFILE…
The expression `\ 'home`' is messed - the first ` is inside the outer single quotes and thus has no special function, the ' before home closes the single quoted part, the second ` opens an unclosed command substitution, inside of which the final ' is. You have to reconsider what you want to have there and get the quote nesting straight.
Try with the below script, which works for me:
# Read query into a variable
sql="$(cat query.sql)"
# If sqlplus is not installed, then exit
if ! command -v sqlplus > /dev/null; then
echo "SQL*Plus is required..."
exit 1
fi
# Connect to the database, run the query, then disconnect
echo -e "SET PAGESIZE 0\n SET FEEDBACK OFF\n $sql" | \
sqlplus -S -L "$USERNAME/$PASSWORD#(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$HOST)(PORT=$PORT))(CONNECT_DATA=(SERVICE_NAME=$DATABASE)))"
I am trying to execute an insert statement from linux shell where one of the columns has '$2a$10$zKjqmgld1gDYB/qkDuAS' in the value. When I see the inserted data the value is truncated and I get only 'aKjqmgld1gDYB/qkDuAS' as any digit followed by dollar is treated by linux as a parameter passed to the script.
This is how I am executing the script
mysql -u user --password=password -e "insert into users(id,name,password) values(1,'Some Name','\$2a\$10\$zKjqmgld1gDYB/qkDuAS')"
I have even tried escaping the $ like \$2a\$10\$zKjqmgld1gDYB/qkDuAS, but still it yields the same truncated data , however when I do echo '\$2a\$10\$zKjqmgld1gDYB/qkDuAS', I get the entire thing back.
Sameer
Single quotes don't nest in shell (do they anywhere else, anyway?). So, your string is effectively outside the quotes. Combine with double quotes and backslashes:
mysql -u user --password=password -e \
"insert into users(id,name,password) values(1,'Some Name','\$2a$10\$zKjqmgld1gDYB/qkDuAS')"
it was already in double quotes (sorry, for writing the wrong query). That didn't work either, however I found a workaround
echo "insert into users(id,name,password) values(1,'Some Name','\$2a\$10\$zKjqmgld1gDYB/qkDuAS')" >> temp.sql
mysql -u user --password=password < temp.sql
This finally worked.
CMD="mysqldump -usomeuser -psomepass db_name \> /../SQL_$(date +'%m-%d-%Y').sql"
The above throws the following exception:
mysqldump: Couldn't find table: ">"
"&1>" also is seen as a table name.
I tried the option -all-database(s) and that doesn't work either.
Thanks!
You must not escape greater-than in the command:
CMD="mysqldump -usomeuser -psomepass db_name > /../SQL_$(date +'%m-%d-%Y').sql"
even then, if you try to execute the command just by invoking it, bash treats the greater-than as a positional parameter. You can execute it with a call to sh or bash:
bash -c "$CMD"