<p>I am trying to query a kubernetes Postgres pod using a bash script where i want to allow user to enter a variable and then use that variable to query. My bash script is as follows:</p>
<pre><code>#!/bin/bash

echo &quot;give a last name&quot;


read t

kubectl exec -it postgres-pod -- bash -c &quot;psql -U postgres -c 'Select * from users WHERE last_name=\&quot;$t\&quot;'&quot;

</code></pre>
<p>I have tried all combinations of single and double quotes but i am unable to pass a string type username. Any suggestions would be appreciated</p>

<p>The simple, but bad, solution is</p>
<pre class="lang-sh prettyprint-override"><code>bash -c &quot;psql -U postgres -c \&quot;Select * from users WHERE last_name='$t'\&quot;&quot;
</code></pre>
<p>This gets the quoting right, but is vulnerable to SQL injection. What if the variable <code>t</code> contains a value with a single quote?</p>
<p>Dealing with that is not so simple; the only way I could think of is using <code>psql</code> variables like this:</p>
<pre class="lang-sh prettyprint-override"><code>echo &quot;Select * from users WHERE last_name = :'var'&quot; | bash -c &quot;psql -U postgres -v var=\&quot;$t\&quot;&quot;
</code></pre>
