how to make sure env variable will not be displayed when ran a script in debug mode

Question

[yesh]$ env | grep password
password=hello

-> tsts is my script which uses env variable password.

[yesh]$ grep password tsts

export DB_PWD="$password"

-> this is my script running in debug mode

[yesh]$ sh -x tsts

+ export DB_DD=yesh
+ DB_DD=yesh
+ export DB_USER=user
+ DB_USER=user
+ export DB_PWD=hello
+ DB_PWD=hello
+ echo 'sqlplus '\''user/hello@yesh'\'''

sqlplus 'user/hello@yesh'

What can i do so that password is not displayed while running script in debug mode??

Answer 1

You need to check and remember the current debug setting, i.e. whether the option -x is in effect when the script is run. Then you need to surround each statement that you don't want to get printed with set +x to turn the option off and set -x to turn it back on when it was initially set. The variable $- contains the options that are in effect when the script runs.

#!/usr/bin/env bash

export DB_DD=yesh
export DB_USER=user

# check and remember current setting of "-x":
if echo $- | grep -q x; then 
    is_debug=1
else
    is_debug=0
fi

[ $is_debug -eq 1 ] && set +x   # temporarily disable "-x"
export DB_PWD=hello             # won't be printed
[ $is_debug -eq 1 ] && set -x   # again enable "-x"

echo 'sqlplus '\''user/hello@yesh'\'''
exit 0;

Output of sh -x tsts:

+ export DB_DD=yesh
+ export DB_USER=user
+ echo x
+ grep -q x
+ is_debug=1
+ [ 1 -eq 1 ]
+ set +x
+ echo sqlplus 'user/hello@yesh'
sqlplus 'user/hello@yesh'
+ exit 0

But keep in mind that this is pointless because everyone who can run your script can also look into it and see the password there.