Question: I have this bash script:

```
databases=`mysql -h$DBHOST -u$DBUSER -p$DBPASSWORD -e "SHOW DATABASES;" | tr -d "| " | grep -v Database`

```

and the issue is when the password has all the characters possible. how can i escape the `$DBPASSWORD` in this case? If I have a password with '!' and given the fact that command is inside backticks. I have no experience in bash scripts but I've tried with `"$DBPASSWORD"` and with `'$DBPASSWORD'` and it doesn't work. Thank you

LATER EDIT: link to script here, line 170 -> <https://github.com/Ardakilic/backmeup/blob/master/backmeup.sh>

Answer: 
First: The [answer from @bishop](https://stackoverflow.com/a/42629315/14122) is spot on: **Don't pass passwords on the command line.**

Second: Use double quotes for all shell expansions. *All of them*. Always.

```
databases=$(mysql -h"$DBHOST" -u"$DBUSER" -p"$DBPASSWORD" -e "SHOW DATABASES;" | tr -d "| " | grep -v Database)

```
I sometimes have the same problem when automating activities:

* I have a variable containing a string (usually a password) that is set in a config file or passed on the command-line, and that string includes the '`!`' character.
* I need to pass that variable's value to another program, as a command-line argument.
* If I pass the variable unquoted, or in double-quotes (`"$password"`), the shell tries to interpret the '`!`', which fails.
* If I pass the variable in single quotes (`'$password'`), the variable isn't expanded.

One solution is to construct the full command in a variable and then use `eval`, for example:

```
#!/bin/bash
username=myuser
password='my_pass!'
cmd="/usr/bin/someprog -user '$username' -pass '$password'"
eval "$cmd"

```

Another solution is to write the command to a temporary file and then `source` the file:

```
#!/bin/bash
username=myuser
password='my_pass!'
cmd_tmp=$HOME/.tmp.$$
touch $cmd_tmp
chmod 600 $cmd_tmp
cat > $cmd_tmp <<END
/usr/bin/someprog -user '$username' -pass '$password'
END
source $cmd_tmp
rm -f $cmd_tmp

```

Using `eval` is simple, but writing a file allows for multiple complex commands.

P.S. Yes, I know that passing passwords on the command-line isn't secure - there is no need for more virtue-signalling comments on that topic.