[Dotenv] Quoting values with $ does not work as expected

[mhujer]

Q	A
Bug report?	yes
Feature request?	no
BC Break report?	no
RFC?	no
Symfony version	4.0.4

When I have following values in .env:

PASSHASH1=$2y$10$kmIn2NJp1tUL0bALk.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa
PASSHASH2='$2y$10$kmIn2NJp1tUL0bALk.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa'
PASSHASH3="$2y$10$kmIn2NJp1tUL0bALk.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa"

And I load them with this code:

<?php declare(strict_types = 1);

use Symfony\Component\Dotenv\Dotenv;

require_once 'vendor/autoload.php';

$dotenv = new Dotenv();
$dotenv->load(__DIR__.'/.env');

var_dump(getenv('PASSHASH1'));
var_dump(getenv('PASSHASH2'));
var_dump(getenv('PASSHASH3'));

The output is:

string(42) "$2y$10.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa"
string(60) "$2y$10$kmIn2NJp1tUL0bALk.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa"
string(42) "$2y$10.X/h.gjZ2b/6wQA72iYsa2PwpnRj544S/tPa"

The 1 and 3 are "broken". Only the variant quoted with ' works as expected. Quotes " are used in an example in documentation, so they should work as well. The non-quoted variant should throw an exception instead of silently changing the value.

I'm using PHP 7.1.12 + Windows 10, but the Dotenv uses PHP to parse the file, so it should not matter.

[mhujer]

It probably has something to do with command embedding using $ sign.

This .env file:

TEST_DOLLAR1=$A$B$C
TEST_DOLLAR2='$A$B$C'
TEST_DOLLAR3="$A$B$C"

Provides those values in PHP:

string(0) ""
string(6) "$A$B$C"
string(0) ""

[nicolas-grekas]

Hello, this is expected: .env is not a Symfony specific standard, but borrows from the sh shell.
You should be able to source .env on Linux boxes and not require Dotenv.
On sh, $FOO or "$FOO"reference another variable, which is what your 1 & 3 variants do.
Closing as this is not a bug but normal behavior.

[mhujer]

@nicolas-grekas thanks for the explanation!

Just a quick question, it means that the default recipe for Doctrine would break if the DB user has a $ in the password? Is there a reason for not changing the quotes to to '?

And similarly in the documentation.

[javiereguiluz]

@mhujer yes ... we updated docs recently to mention this: https://symfony.com/doc/current/doctrine.html#configuring-the-database

[stof]

@nicolas-grekas does Dotenv supports single quotes properly ? If yes, it might be an option here.

[nicolas-grekas]

it does, see above report, the singly quoted string is the one that works in this case

[stof]

then we should indeed update the Doctrine recipe to use single quotes. People are more like to put a $ there because of the password containing one than because of nesting env vars IMO (and people nesting env vars will generally know they need to use double quotes or no quotes for that to work)

[nicolas-grekas]

Agreed, here we are: symfony/recipes#361