Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is difference between $* and $@ positional variable in linux. I read somewhere using $* is is security risk. Is it true.

share|improve this question

Basically they're the same except when the variable is enclosed in double quotes. Then $* expands to a single word and $@ expands to separate words. I don't see any merit to claims that $* is a security risk.

From the bash man page:

   *      Expands  to  the positional parameters, starting from one.  When
          the expansion occurs within double quotes, it expands to a  sin-
          gle word with the value of each parameter separated by the first
          character of the IFS special variable.  That is, "$*" is equiva-
          lent to "$1c$2c...", where c is the first character of the value
          of the IFS variable.  If IFS is unset, the parameters are  sepa-
          rated  by  spaces.   If  IFS  is null, the parameters are joined
          without intervening separators.
   @      Expands to the positional parameters, starting from  one.   When
          the  expansion  occurs  within  double  quotes,  each  parameter
          expands to a separate word.  That is, "$@" is equivalent to "$1"
          "$2"  ...   If the double-quoted expansion occurs within a word,
          the expansion of the first parameter is joined with  the  begin-
          ning  part  of  the original word, and the expansion of the last
          parameter is joined with the last part  of  the  original  word.
          When  there  are no positional parameters, "$@" and $@ expand to
          nothing (i.e., they are removed).
share|improve this answer
I don't get your sentence "It should always be quoted, of course" unless you are referring to "$@". – jlliagre Apr 7 '11 at 10:00
Fair enough. That was needlessly and perhaps confusingly broad. Redacted. – Insyte Apr 7 '11 at 15:56
The security risk I can think is expanding to the wrong thing. Suppose you have a file list with two files "rm" and "-f /". $* will expand to "rm -rf /" while $@ will expand correctly to "rm" and "-f /". That's a crude example, but you can see how $* can go wrong on a for loop or related. – coredump Apr 7 '11 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.