Text-only	Table of Contents (frame/ no frame)
(28) Security

• Don't use set-UID scripts.

• Always explicitly set $PATH at the start of a script, so that you know exactly which external programs will be used.

• If possible, don't use temporary files. If they cannot be avoided, use $TMPDIR, and create files safely (e.g. mktemp).

• Check exit status of everything you do.

• Don't trust user input
  • contents of files
  • data piped from other programs
  • file names. Output of filename generation with wildcards, or directly from ls or find

Example:
Consider the effects of a file named "myfile;cd /;rm *" if processed, unquoted, by your script.