How do I tell linux bash to ignore backticks? - mysql

Question

I'm writing a chef recipe that calls the mysql command and executes a query. The problem is that the query passed into this command can have backticks, and I have no control over that. EG I'll do something like this:
execute "update_customer_segment_custom_condition_#{no_space_segment_name}" do
action :run
command "mysql --user=#{user} #{db_name} --execute="CALL someStoredProcedure(\"A String\", \"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\");"
end
but Bash always complains about the syntax because it tries to interpret the backticks and evaluate. How can I tell it to completely ignore that character?
FYI this is being called inside a chef execute block as a command, hence using # for variables.

Answer 1

You could also use an execute resource in Chef instead of bash. That won't use bash and thus backticks have no special meaning.
EDIT:
To be more specific with the example resource you posted
execute "update_customer_segment_custom_condition_#{no_space_segment_name}" do
command ['mysql', "--user=#{user}", db_name, '--execute="CALL someStoredProcedure(\"A String\", \"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\");"']
end
The array form for command shuts off any processing by the shell.

Answer 2

this is probably because you build a string with ruby (I dont' know ruby) and then pass it into a shell execute with action run
This already has a problem as your double quotes terminate in middle string:
command "mysql --user=#{user} #{db_name} --execute="CALL someStoredProcedure(\"A String\", \"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\");"
so I wonder if ruby does not give a syntax error here for the supplemental " at the end.
the string you want to generate looks (probably) like this:
mysql --user=#{user} #{db_name} --execute="CALL someStoredProcedure(\"A String\", \"A QUERY\");"
you need to generate it like that:
mysql --user=#{user} #{db_name} --execute='CALL someStoredProcedure("A String", "A QUERY");"
And the part with "A QUERY" you need to replace all occurences of ' with '\'' else you can still get a shell code injection.