From: "Sandor Szücs" <sandor.szuecs@...>
Date: 2008-07-22T01:52:45+09:00
Subject: Re: Run command after Prompting from User...

On 21.07.2008, at 12:00, Usman Akram wrote:

> i do this but not working :-(
>
> user_name = gets
>
> system ('adduser -m $user_name')

0)
Try that in the Interactive Ruby (irb) and you will get the problem.

1)
user_name is your local defined variable, $user_name is another, global
variable name.
$user_name.nil? # returns true

2)
If you want to use your variable in a string you have to use  
doublequotes "
instead of singlequotes ' and in ruby you can use the following syntax:
"mystring #{var}"
"mystring "+ var
"mystring " << var

one simple solution with proof of shell injection is:

tries = 0
username = ""
while not username.match(/\A[a-zA-Z0-9]+\Z/)
   tries = tries.succ
   exit! if tries > 3
print "username: "
username = gets.chomp.strip
end
system('adduser -m ' + username)



regards, Sandor Szücs
--