From: Gary Wright <gwtmp01@...>
Date: 2009-12-04T08:20:11+09:00
Subject: Re: System function using variables from fieldset


On Dec 3, 2009, at 6:07 PM, Gregory Brown wrote:

> On Thu, Dec 3, 2009 at 4:18 PM, Bill Mccarthy
> <bill@vocaticommunications.com> wrote:
>> Rick:
>> 
>> Thank you for the reply.  I really appreciate your input.
>> 
>> If you were FORCED to do it this way, what would the syntax be in this
>> case for this system statement to create the directory.
> 
> You basically can't.  See Rick's first point.

If you are insisting that it be done in the view, then Greg is right
because you won't have the necessary data (the directory name from the
form input field) at the time the view code is executed.

If you are just asking how you dynamically construct an argument to system,
use string interpolation:

dirname = "foobar"
system("mkdir #{dirname}")

alternatively you can pass separate arguments to system:

system("mkdir", dirname)

When you pass multiple arguments, the command is not subject to shell expansion.

Finally, be very, very careful about constructing commands from user input.
This is a great way to create a code injection security nightmare.  You really
have to sanitize the data before you use it to construct commands.

Gary Wright