Triage needed; Some bugs and annoyances I found

Passing Passwords Insecurely

After typing 'export SQLCMDPASSWORD=...', the environment variable is visible to all child processes (any command and background process started by the shell). When creating a user (or with any operation needing a password), it would be wiser to read the password form STDIN.

Segfault

I have this segfault. I solved it by deleting sqlcmd's config file.

[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x81990d]

goroutine 1 [running]:
github.com/microsoft/go-sqlcmd/internal/config.GetCurrentContextInfo()
       /home/vsts/work/1/s/internal/config/context.go:105 +0x10d
main.initializeEnvVars()
       /home/vsts/work/1/s/cmd/modern/main.go:83 +0xcf
main.main()
       /home/vsts/work/1/s/cmd/modern/main.go:51 +0x20c

-?

? is a special character on Linux shells, so we're forced to put quotes around ('-?'). Conventions recommend using -h or --help.

XDG Directories

A lot of softwares dumps their cache/config/data/whatever in ~/.<appname>, polluting the user's home. XDG users directories are standard directories for well-known data type (configurations, appdata, cache...). For sqlcmd, on such path would be ~/.config/sqlcmd instead of ~/.sqlcmd. Right now, I have 21 applications managing their configuration the annoying way, and it would be delightful if sqlcmd did better than them.

Can't use empty passwords

MSSQL logins without passwords can exist, yet I can't add one through sqlcmd config add-user.

liner

Whenever I use sqlcmd in a shell script I get this error: liner: function not supported in this terminal

sqlcmd: v0.15.4
I apologize for the triage this issue may impose, or if I brought already mentioned issues.

Treat this as a triage bundle rather than one change. Start with internal/config/context.go:105 and cmd/modern/main.go:83,51 for the reported crash, then inspect config add-user and the liner handling for the other reports. Done means separating the concerns into focused, reproducible issues with clear scope and confirmation of which reports remain valid.