Use config file for my shell script

source is not secure as it will execute arbitrary code. This may not be a concern for you, but if file permissions are incorrect, it may be possible for an attacker with filesystem access to execute code as a privileged user by injecting code into a config file loaded by an otherwise-secured script such as an init script.

So far, the best solution I've been able to identify is the clumsy reinventing-the-wheel solution:

myfile.conf

username=foo
password=bar
echo rm -rf /
PS1=h4xx0r3d
hostname=localhost; echo rm -rf /

Using source, this would run echo rm -rf / twice, as well as change the running user's PS1. Instead, do this:

myscript.sh

#!/bin/bash
typeset -A config # init array
config=( # set default values in config array
    [username]="root"
    [password]=""
    [hostname]="localhost"
)

while read line
do
    if echo $line | grep -F = &>/dev/null
    then
        varname=$(echo "$line" | cut -d '=' -f 1)
        config[$varname]=$(echo "$line" | cut -d '=' -f 2-)
    fi
done < myscript.conf

echo ${config[username]} # should be loaded from config file
echo ${config[password]} # should be loaded from config file
echo ${config[hostname]} # includes the "injected" code, but in our array it's no threat
echo ${config[PS1]} # also respects variables that you may not have been looking for,
                    # but they're sandboxed inside the $config array

I hope this helps. Please reply if you find a security exploit in my code.

You can do it:

#!/bin/bash
name="mohsen"
age=35
cat > /home/myuser/test/config << EOF
Name=$name
Age=$age
EOF

The most common, efficient and correct way is to use source, or . as a shorthand form. For example:

source /home/myuser/test/config

or

. /home/myuser/test/config

Something to consider, however, is the security issues that using an additional externally-sourced configuration file can raise, given that additional code can be inserted. For more information, including on how to detect and resolve this issue, I would recommend taking a look at the 'Secure it' section of http://wiki.bash-hackers.org/howto/conffile#secure_it