Variables

Overview

The shell is not just for typing commands — it is a small programming environment, and variables are its foundation. They store values you can reuse, and special environment variables shape how the whole system behaves. This lesson explains shell variables.

Learning objectives

• Define shell variables and how to set and read them.
• Distinguish shell variables from environment variables.
• Identify important environment variables.

Core concept

A variable stores a value under a name. In Bash:

• Set a variable with name=value (no spaces around =).
• Read it by prefixing $: echo "$name".

There are two scopes:

• Shell (local) variables — exist only in the current shell.
• Environment variables — exported (with export) so child processes inherit them. Important ones include PATH (where commands are searched for), HOME (your home directory), USER, and PWD.

How it works

Assigning name=value creates a shell variable; export name (or export name=value) promotes it to the environment so programs you launch can see it. When you run a command, the shell searches the directories listed in PATH (in order) to find the executable. Quoting matters: use "$var" (double quotes) to safely expand a variable while preserving spaces, and remember unquoted expansions can break on spaces or special characters.

Practical example

$ name="Alice"
$ echo "Hello, $name"
Hello, Alice
$ echo "$PATH"
/usr/local/bin:/usr/bin:/bin
$ export EDITOR=nano      # now child programs know your preferred editor

name is a local variable; PATH is an environment variable listing where commands are found; export EDITOR=nano makes that preference available to programs the shell launches.

Cybersecurity relevance

Environment variables have real security weight. PATH is a classic concern: if a writable or attacker-controlled directory appears early in PATH, a malicious program named like a common command could be run instead of the real one (a PATH hijacking / search-order attack). Storing secrets in environment variables is convenient but risky, since they can leak via process listings or child processes. Understanding variable scope and quoting also prevents scripting bugs that become security issues.

Common mistakes

• Putting spaces around = in assignments (name = value fails) — it must be name=value.
• Forgetting to quote expansions ("$var"), causing word-splitting bugs.
• Trusting PATH order blindly, enabling search-order hijacking if a writable dir comes first.

Key takeaways

• Set variables with name=value (no spaces) and read them with $name; quote as "$var" to handle spaces safely.
• Shell variables are local; exported environment variables (like PATH, HOME, USER) are inherited by child processes.
• PATH search order and secrets in environment variables are security-sensitive — mis-set PATH enables hijacking, and env secrets can leak.

Check your understanding

• What is the difference between a shell variable and an environment variable?
• Why can the order of directories in PATH be a security concern?