Repository navigation
set_key does not handle single quote ' inside value properly #543
Description
Problem
set_key function does not properly handle single quote ' inside value.
python-dotenv version: 1.0.1
Related PR
How to reproduce
- Run python script below
- Run
source .env
Python Script
from dotenv import set_key
def main():
var_value = "I'm a bug :("
set_key(".env", "VAR", var_value)
if __name__ == "__main__":
main()Error from source .env
bash: .env: line 1: syntax error near unexpected token `('
bash: .env: line 1: `VAR='I\'m a bug :(''Example of fix
dotenv cannot parse (see this issue)
from dotenv import set_key
def fixed_set_key(file_path, key, value):
# properly escape ' if present
# https://stackoverflow.com/questions/8254120/how-can-i-escape-a-single-quote-in-a-single-quote-string-in-bash/26165123#26165123
value = value.replace("'", "'\"'\"'")
set_key(file_path, key, f"'{value}'", quote_mode="never")
def main():
var_value = "I'm a fixed :)"
fixed_set_key(".env", "VAR", var_value)
if __name__ == "__main__":
main()
Activity
theskumar commentedon Aug 16, 2026
Grouping the shell-quoting work here so it's easy to track:
#670 makes the
export=Truepath shell-safe - for a value like this it writesexport VAR="I'm a bug :(", which bothsourceand dotenv read back correctly. So the export case is covered there.The exact repro in this issue is the default (non-export) path though, and that's still open:
set_key(".env", "VAR", "I'm a bug :(")writesVAR='I\'m a bug :(', which dotenv parses back fine but bash can'tsource(a\'inside single quotes isn't valid in bash). Worth deciding separately whether non-export output should be POSIX-sourceable at all, since that's a slightly different contract from "dotenv can round-trip it".Related: #544 is the parser side of the same theme (reading a hand-written
'I'\''m'bash-concat value), and #670 doesn't touch the parser, so that one stands on its own too.