Hacker News new | past | comments | ask | show | jobs | submit login

> Maybe the solution is to follow SQL and implement a prepared-query system for shell commands?

You mean shell scripts?




No. Shell scripts have the same problem where you're not separating options from filenames and you're often not preventing a single user-supplied argument from expanding into multiple final arguments.

The list-form shell commands referenced earlier are closer, but still don't separate filenames (input) from arguments unless you remember to add "--".

But they do prevent things like pipes, which is a big deal.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: