What is difference between $* and $@ positional variable in linux. I read somewhere using $* is is security risk. Is it true.
Basically they're the same except when the variable is enclosed in double quotes. Then
$* expands to a single word and
$@ expands to separate words. I don't see any merit to claims that
$* is a security risk.
From the bash man page:
* Expands to the positional parameters, starting from one. When the expansion occurs within double quotes, it expands to a sin- gle word with the value of each parameter separated by the first character of the IFS special variable. That is, "$*" is equiva- lent to "$1c$2c...", where c is the first character of the value of the IFS variable. If IFS is unset, the parameters are sepa- rated by spaces. If IFS is null, the parameters are joined without intervening separators. @ Expands to the positional parameters, starting from one. When the expansion occurs within double quotes, each parameter expands to a separate word. That is, "$@" is equivalent to "$1" "$2" ... If the double-quoted expansion occurs within a word, the expansion of the first parameter is joined with the begin- ning part of the original word, and the expansion of the last parameter is joined with the last part of the original word. When there are no positional parameters, "$@" and $@ expand to nothing (i.e., they are removed).