You can make Bash's
read built emit a prompt by using its
read -p "Database name: " databaseName
and you can make it turn off echoing with
read -s -p "Database password for $user: " password
"$password" into the
mysql command line like that - as the man page says:
Specifying a password on the command line should be considered insecure. See Section 184.108.40.206, “End-User Guidelines for Password Security”. You can use an option file to avoid giving the password on the command line.
It also says
If you omit the password value following the
-p option on the command line, mysql prompts for one.
So I'd recommend not reading the password in this script, but passing
--password to tell mysql to do its own prompting.
The other thing that's dangerous is using user input to construct the SQL query string - even if your users are trusted (and you know they have permission to connect and execute this command), it's worth validating the strings to prevent accidents. An alternative could be to use Bash to quote the arguments:
command=$(printf 'UPDATE messages SET message = REPLACE(message, %q, %q') \
mysql --user="$user" --password \
--host="$databaseHost" --database="$databaseName" \
It may be worth writing the script in a different language (or passing these variables to a sub-script in the different language), to enable the use of prepared statements. I thought there might be a way to define variables for the mysql command like you can for Awk, and then use them in statements, but I couldn't find any provision for that, unfortunately.
An enhancement I would make is to ask for confirmation after reading all the interactive inputs. Right now, if I make a mistake in
replaceUrl (e.g. I manage to press \ and Enter together), then I don't get a chance to interrupt the update. At the very least
sleep 2 && mysql so I can Control+C before it's too late.