Tilde expansion without eval

Question

I need to get user home folder. At the moment I'm using this

home=$(eval echo ~$user)

Content of $user is provided by the caller, so not trusted value. Is the use of the eval dangerous here? If yes (probably), how to solve it without it?

Answer 1

On systems that have it, you can use getent(1):

$ getent passwd "$username" | cut -d: -f 6
/path/to/user/home

Make sure to check for empty results though.