From 70172a0dbd011db83df945e92fda7ccd3fa622d6 Mon Sep 17 00:00:00 2001
From: Test User <test@test.com>
Date: Sat, 1 Aug 2026 09:11:23 +0500
Subject: [PATCH] Prevent SQL injection via POSTGRES_PASSWORD in init_db

---
 start | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/start b/start
index 47d7e2d2..1ed279d6 100755
--- a/start
+++ b/start
@@ -472,10 +472,10 @@ function init_db() {
   if [ "$ENABLE_CORE" = "true" ] && [ "$CORE_USE_POSTGRES" = "true" ]; then
     run_silent "create-core-db" sudo -u postgres createdb core
   fi
-  run_silent "stellar-postgres-user" sudo -u postgres psql <<-SQL
-    CREATE USER $PGUSER WITH PASSWORD '$PGPASS';
-    $([ "$ENABLE_HORIZON" = "true" ] && echo "GRANT ALL PRIVILEGES ON DATABASE horizon to $PGUSER;")
-    $([ "$ENABLE_CORE" = "true" ] && [ "$CORE_USE_POSTGRES" = "true" ] && echo "GRANT ALL PRIVILEGES ON DATABASE core to $PGUSER;")
+  run_silent "stellar-postgres-user" sudo -u postgres psql -v pguser="$PGUSER" -v pgpass="$PGPASS" <<-SQL
+    CREATE USER :"pguser" WITH PASSWORD :'pgpass';
+    $([ "$ENABLE_HORIZON" = "true" ] && echo "GRANT ALL PRIVILEGES ON DATABASE horizon to :\"pguser\";")
+    $([ "$ENABLE_CORE" = "true" ] && [ "$CORE_USE_POSTGRES" = "true" ] && echo "GRANT ALL PRIVILEGES ON DATABASE core to :\"pguser\";")
 SQL
 
   touch .quickstart-initialized