Issue with "#" in perl scripting - perl

Question

I am developing an automation script in perl in which for authentication I have written a subroutine which takes password input by user and return it to the main perl program which in turn passes the password to the tool that I need to automate.
This script goes fine with every case unless the character # is part of the password. Then it is not able to automate the tool and fails for authentication.
Below is the subroutine which I used for taking password input.
use Win32::Console;
sub password() {
$StdIn = new Win32::Console(STD_INPUT_HANDLE);
my $Password = "";
$StdIn->Mode(ENABLE_PROCESSED_INPUT);
print "Enter Password: ";
while (ord(my $Data = $StdIn->InputChar(1)) != 10) {
if("\r" eq $Data ) {
last;
}
elsif ("\ch" eq $Data) {
if( "" ne chop( $Password )) {
print "\ch \ch";
}
next;
}
$Password .=$Data;
print "*";
}
return $Password;
}
i am calling the above subroutine as
$passwd = &password();
And then passing the $passwd to the tool that I need to automate as below,
This is the line in which I pass the password to tool,
cc -c URL OF THE TOOL:$server -d $domain -t $appl -u $userid -p $passwd; \n";
Can anyone please cross check the code for calling the password() sub routine, returning $password and passing $passwd to the tool. I think error may be at one of the three places.Someone please help and if possible provide the code too.

Answer 1

You are probably passing the user input to an external tool of some sort that doesn't support literal #, perhaps because it is interpreted as "start of comment". The shell is a likely suspect. But without sample code, it is impossible for us to be sure what your problem is.

Answer 2

It seems to me like issue with quoting on the shell side. Proper quoting rules are entirely dependent on your system's command shell. In bash, for example, you can often be fairly safe with something like -p '$password', while transliterating ' to \' in the Perl script. Or there could be a module for that, of which I'm not aware.
However, it's the "cc" thing you're passing data into. The tool could could support easier way to safely pass the password, i.e. avoid the need of quoting arbitrary data. Examples of such facilities are via STDIN, via external file (well that could be actually pretty unsafe :)) or as a null-terminated string. Or passing the hash only. So I'd look into the documentation.
Be aware that by passing user collected data into shell, you're posing a great security risk. Consider using Perl's Taint mode.
Update: You say it's Windows, so I should warn you: quoting for cmd.exe is one of the most complicated, painful and frustrating things I've ever done. Have a look at this question