I always thought that with a parameter expansion such as $foo, the shell replaces $foo with the contents of the parameter before executing the command.
If, for example, I set
foo='`'
Why then, does
ls $foo
have different behavior than
ls `
?
bash has several distinct phases in the processing of a command line. Relevant here are the parsing phase and the expansion phase. The phases
occur in order, and one phase does not begin until the previous phase completes.
In the first example, the parser never sees the backquote; that is supplied by the expansion of $foo which occurs after parsing is complete. As a result, a literal backquote is passed to ls as an argument.
In the second example, the parser sees an unquoted backquote, which indicates the beginning of a command substitution.