Safe pattern modification (expansion modifiers)
Instead of sending a variable to external utilities like sed, awk, or cut to clean it up (which spawns a subshell and can introduce injection points), use Bash’s built-in string manipulation.
These modifiers are entirely safe from shell injection because they happen inside the memory of the current shell process.
# Given a user-inputted file path:
user_input="/home/user/documents/report.pdf"
# 1. Strip everything up to the last slash (Get filename)
filename="${user_input##*/}" # Result: "report.pdf"
# 2. Strip the extension from the end
name_only="${filename%.*}" # Result: "report"
# 3. Replace all spaces with underscores safely
safe_name="${user_input// /_}"