diff --git a/dracut-functions.sh b/dracut-functions.sh
index 280e4e7823..6e3807b23f 100755
--- a/dracut-functions.sh
+++ b/dracut-functions.sh
@@ -712,7 +712,7 @@ fs_get_option() {
     while [ $# -gt 0 ]; do
         case $1 in
             $_option=*)
-                echo "${1#${_option}=}"
+                echo "${1#"${_option}"=}"
                 break
                 ;;
         esac
diff --git a/dracut-init.sh b/dracut-init.sh
index 40b66f54f6..9c9340cfc3 100755
--- a/dracut-init.sh
+++ b/dracut-init.sh
@@ -573,7 +573,7 @@ inst_rules_wildcard() {
 # make sure that library links are correct and up to date
 build_ld_cache() {
     for f in "$dracutsysrootdir"/etc/ld.so.conf "$dracutsysrootdir"/etc/ld.so.conf.d/*; do
-        [[ -f $f ]] && inst_simple "${f#$dracutsysrootdir}"
+        [[ -f $f ]] && inst_simple "${f#"$dracutsysrootdir"}"
     done
     if ! $DRACUT_LDCONFIG -r "$initdir" -f /etc/ld.so.conf; then
         if [[ $EUID == 0 ]]; then
@@ -696,8 +696,8 @@ inst_libdir_file() {
         for _dir in $libdirs; do
             for _i in "$@"; do
                 for _f in "$dracutsysrootdir$_dir"/$_i; do
-                    [[ ${_f#$dracutsysrootdir} =~ $_pattern ]] || continue
-                    [[ -e $_f ]] && _files+=("${_f#$dracutsysrootdir}")
+                    [[ ${_f#"$dracutsysrootdir"} =~ $_pattern ]] || continue
+                    [[ -e $_f ]] && _files+=("${_f#"$dracutsysrootdir"}")
                 done
             done
         done
@@ -705,7 +705,7 @@ inst_libdir_file() {
         for _dir in $libdirs; do
             for _i in "$@"; do
                 for _f in "$dracutsysrootdir$_dir"/$_i; do
-                    [[ -e $_f ]] && _files+=("${_f#$dracutsysrootdir}")
+                    [[ -e $_f ]] && _files+=("${_f#"$dracutsysrootdir"}")
                 done
             done
         done
diff --git a/dracut.sh b/dracut.sh
index bbb346970e..901ed09e94 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -958,6 +958,7 @@ if [[ $regenerate_all == "yes" ]]; then
     for ((i = 0; i < len; i++)); do
         case ${dracut_args[$i]} in
             --regenerate-all | --parallel)
+                # shellcheck disable=SC2184
                 unset dracut_args["$i"]
                 ;;
         esac
@@ -999,7 +1000,7 @@ for i in $DRACUT_PATH; do
     if [ -L "$dracutsysrootdir$i" ]; then
         rl=$(readlink -f "$dracutsysrootdir$i")
     fi
-    rl="${rl#$dracutsysrootdir}"
+    rl="${rl#"$dracutsysrootdir"}"
     if [[ $NPATH != *:$rl* ]]; then
         NPATH+=":$rl"
     fi
@@ -2212,7 +2213,7 @@ for ((i = 0; i < ${#include_src[@]}; i++)); do
                 [[ -e $objectname || -L $objectname ]] || continue
                 if [[ -d $objectname ]] && [[ ! -L $objectname ]]; then
                     # objectname is a directory, let's compute the final directory name
-                    object_destdir=${destdir}/${objectname#$src/}
+                    object_destdir=${destdir}/${objectname#"$src"/}
                     if ! [[ -e $object_destdir ]]; then
                         # shellcheck disable=SC2174
                         mkdir -m 0755 -p "$object_destdir"
diff --git a/modules.d/03modsign/module-setup.sh b/modules.d/03modsign/module-setup.sh
index 08fd3418b4..56e2bdb835 100755
--- a/modules.d/03modsign/module-setup.sh
+++ b/modules.d/03modsign/module-setup.sh
@@ -33,6 +33,6 @@ install() {
 
     for x in "$dracutsysrootdir"/lib/modules/keys/*; do
         [[ ${x} == "$dracutsysrootdir/lib/modules/keys/*" ]] && break
-        inst_simple "${x#$dracutsysrootdir}"
+        inst_simple "${x#"$dracutsysrootdir"}"
     done
 }
diff --git a/modules.d/10i18n/console_init.sh b/modules.d/10i18n/console_init.sh
index 3fe3b673d5..3ca0ac1d13 100755
--- a/modules.d/10i18n/console_init.sh
+++ b/modules.d/10i18n/console_init.sh
@@ -19,7 +19,7 @@ set_keyboard() {
 }
 
 set_terminal() {
-    local dev=$1
+    local dev="$1"
 
     if [ "${UNICODE}" = 1 ]; then
         printf '\033%%G' >&7
@@ -58,7 +58,7 @@ dev_close() {
 }
 
 dev_open() {
-    local dev=$1
+    local dev="$1"
 
     exec 6< "${dev}" \
         && exec 7>> "${dev}"
diff --git a/modules.d/35network-legacy/dhclient-script.sh b/modules.d/35network-legacy/dhclient-script.sh
index 82fc7e2c2c..240c0fad50 100755
--- a/modules.d/35network-legacy/dhclient-script.sh
+++ b/modules.d/35network-legacy/dhclient-script.sh
@@ -72,7 +72,7 @@ setup_interface() {
     fi
     # Note: hostname can be fqdn OR short hostname, so chop off any
     # trailing domain name and explicity add any domain if set.
-    [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
+    [ -n "$hostname" ] && echo "echo ${hostname%."$domain"}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
 }
 
 setup_interface6() {
@@ -105,7 +105,7 @@ setup_interface6() {
 
     # Note: hostname can be fqdn OR short hostname, so chop off any
     # trailing domain name and explicity add any domain if set.
-    [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
+    [ -n "$hostname" ] && echo "echo ${hostname%."$domain"}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
 }
 
 parse_option_121() {
diff --git a/modules.d/35network-legacy/parse-bond.sh b/modules.d/35network-legacy/parse-bond.sh
index 86cd89ce69..ba30a3bc7b 100755
--- a/modules.d/35network-legacy/parse-bond.sh
+++ b/modules.d/35network-legacy/parse-bond.sh
@@ -15,7 +15,7 @@
 # We translate list of slaves to space-separated here to make it easier to loop over them in ifup
 # Ditto for bonding options
 parsebond() {
-    local v=${1}:
+    local v="${1}":
     set --
     while [ -n "$v" ]; do
         set -- "$@" "${v%%:*}"
diff --git a/modules.d/35network-legacy/parse-bridge.sh b/modules.d/35network-legacy/parse-bridge.sh
index f15ce4707b..caea1dad7a 100755
--- a/modules.d/35network-legacy/parse-bridge.sh
+++ b/modules.d/35network-legacy/parse-bridge.sh
@@ -8,7 +8,7 @@
 #
 
 parsebridge() {
-    local v=${1}:
+    local v="${1}":
     set --
     while [ -n "$v" ]; do
         set -- "$@" "${v%%:*}"
diff --git a/modules.d/35network-legacy/parse-ip-opts.sh b/modules.d/35network-legacy/parse-ip-opts.sh
index 19af878965..6a90f2a1da 100755
--- a/modules.d/35network-legacy/parse-ip-opts.sh
+++ b/modules.d/35network-legacy/parse-ip-opts.sh
@@ -139,7 +139,7 @@ fi
 
 # This ensures that BOOTDEV is always first in IFACES
 if [ -n "$BOOTDEV" ] && [ -n "$IFACES" ]; then
-    IFACES="${IFACES%$BOOTDEV*} ${IFACES#*$BOOTDEV}"
+    IFACES="${IFACES%"$BOOTDEV"*} ${IFACES#*"$BOOTDEV"}"
     IFACES="$BOOTDEV $IFACES"
 fi
 
diff --git a/modules.d/35network-legacy/parse-team.sh b/modules.d/35network-legacy/parse-team.sh
index 7b1801ba45..83badc9980 100755
--- a/modules.d/35network-legacy/parse-team.sh
+++ b/modules.d/35network-legacy/parse-team.sh
@@ -10,7 +10,7 @@
 #
 
 parseteam() {
-    local v=${1}:
+    local v="${1}":
     set --
     while [ -n "$v" ]; do
         set -- "$@" "${v%%:*}"
diff --git a/modules.d/35network-legacy/parse-vlan.sh b/modules.d/35network-legacy/parse-vlan.sh
index 1570cd8124..c23f83315a 100755
--- a/modules.d/35network-legacy/parse-vlan.sh
+++ b/modules.d/35network-legacy/parse-vlan.sh
@@ -5,7 +5,7 @@
 #
 
 parsevlan() {
-    local v=${1}:
+    local v="${1}":
     set --
     while [ -n "$v" ]; do
         set -- "$@" "${v%%:*}"
diff --git a/modules.d/40network/net-lib.sh b/modules.d/40network/net-lib.sh
index bc1ffcde96..43467e4607 100755
--- a/modules.d/40network/net-lib.sh
+++ b/modules.d/40network/net-lib.sh
@@ -243,7 +243,7 @@ set_ifname() {
 
 # pxelinux provides macaddr '-' separated, but we need ':'
 fix_bootif() {
-    local macaddr=${1}
+    local macaddr="${1}"
     local IFS='-'
     # shellcheck disable=SC2086
     macaddr=$(printf '%s:' ${macaddr})
@@ -395,11 +395,11 @@ parse_iscsi_root() {
             iscsi_target_ip=${v#[[]}
             iscsi_target_ip=${iscsi_target_ip%%[]]*}
             # shellcheck disable=SC1087
-            v=${v#[[]$iscsi_target_ip[]]:}
+            v=${v#[[]"$iscsi_target_ip"[]]:}
             ;;
         *)
             iscsi_target_ip=${v%%[:]*}
-            v=${v#$iscsi_target_ip:}
+            v=${v#"$iscsi_target_ip":}
             ;;
     esac
 
@@ -467,7 +467,7 @@ parse_iscsi_root() {
 }
 
 ip_to_var() {
-    local v=${1}:
+    local v="${1}":
     local i
     set --
     while [ -n "$v" ]; do
@@ -476,7 +476,7 @@ ip_to_var() {
             i="${v%%\]:*}"
             i="${i##\[}"
             set -- "$@" "$i"
-            v=${v#\[$i\]:}
+            v=${v#\["$i"\]:}
         else
             set -- "$@" "${v%%:*}"
             v=${v#*:}
@@ -565,7 +565,7 @@ ip_to_var() {
 }
 
 route_to_var() {
-    local v=${1}:
+    local v="${1}":
     local i
     set --
     while [ -n "$v" ]; do
@@ -574,7 +574,7 @@ route_to_var() {
             i="${v%%\]:*}"
             i="${i##\[}"
             set -- "$@" "$i"
-            v=${v#\[$i\]:}
+            v=${v#\["$i"\]:}
         else
             set -- "$@" "${v%%:*}"
             v=${v#*:}
@@ -691,7 +691,7 @@ wait_for_route_ok() {
 
     while [ $cnt -lt $timeout ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/modules.d/45url-lib/module-setup.sh b/modules.d/45url-lib/module-setup.sh
index afbedb34fc..65da87ee8c 100755
--- a/modules.d/45url-lib/module-setup.sh
+++ b/modules.d/45url-lib/module-setup.sh
@@ -45,7 +45,7 @@ install() {
     done
     if [[ $_found ]] && [[ -n $_crts ]]; then
         for _crt in $_crts; do
-            if ! inst "${_crt#$dracutsysrootdir}"; then
+            if ! inst "${_crt#"$dracutsysrootdir"}"; then
                 dwarn "Couldn't install '$_crt' SSL CA cert bundle; HTTPS might not work."
                 continue
             fi
@@ -78,7 +78,7 @@ install() {
                         # install everything in it
                         mkdir -p -- "${initdir}/${_p11root}"
                         if ! $DRACUT_CP -L -t "${initdir}/${_p11root}" "${dracutsysrootdir}${_p11root}"/*; then
-                            dwarn "Couldn't install from p11-kit trust dir '${_p11root#$dracutsysrootdir}'; HTTPS might not work."
+                            dwarn "Couldn't install from p11-kit trust dir '${_p11root#"$dracutsysrootdir"}'; HTTPS might not work."
                         fi
                     done
                 done
diff --git a/modules.d/45url-lib/url-lib.sh b/modules.d/45url-lib/url-lib.sh
index b009fd0977..2fd6951948 100755
--- a/modules.d/45url-lib/url-lib.sh
+++ b/modules.d/45url-lib/url-lib.sh
@@ -141,7 +141,7 @@ nfs_already_mounted() {
             if [ "$path" = "$p" ]; then
                 echo "$mnt"
             elif str_starts "$path" "$p"; then
-                echo "$mnt"/"${path#$p/}"
+                echo "$mnt"/"${path#"$p"/}"
             fi
         fi
     done < /proc/mounts
diff --git a/modules.d/50plymouth/plymouth-populate-initrd.sh b/modules.d/50plymouth/plymouth-populate-initrd.sh
index 52baa21059..e36ed521d6 100755
--- a/modules.d/50plymouth/plymouth-populate-initrd.sh
+++ b/modules.d/50plymouth/plymouth-populate-initrd.sh
@@ -34,10 +34,10 @@ if [[ $hostonly ]]; then
 else
     for x in "$dracutsysrootdir"/usr/share/plymouth/themes/{text,details}/*; do
         [[ -f $x ]] || continue
-        THEME_DIR=$(dirname "${x#$dracutsysrootdir}")
+        THEME_DIR=$(dirname "${x#"$dracutsysrootdir"}")
         # shellcheck disable=SC2174
         mkdir -m 0755 -p "${initdir}/$THEME_DIR"
-        inst_multiple "${x#$dracutsysrootdir}"
+        inst_multiple "${x#"$dracutsysrootdir"}"
     done
     (
         cd "${initdir}"/usr/share/plymouth/themes || exit
diff --git a/modules.d/90crypt/crypt-lib.sh b/modules.d/90crypt/crypt-lib.sh
index 7a88643cca..f3ba20dcc7 100755
--- a/modules.d/90crypt/crypt-lib.sh
+++ b/modules.d/90crypt/crypt-lib.sh
@@ -141,7 +141,7 @@ ask_for_password() {
 # example:
 # test_dev -f LABEL="nice label" /some/file1
 test_dev() {
-    local test_op=$1
+    local test_op="$1"
     local dev="$2"
     local f="$3"
     local ret=1
diff --git a/modules.d/90crypt/parse-crypt.sh b/modules.d/90crypt/parse-crypt.sh
index 70e96444ab..e46e347ac5 100755
--- a/modules.d/90crypt/parse-crypt.sh
+++ b/modules.d/90crypt/parse-crypt.sh
@@ -53,7 +53,7 @@ else
 
             uuid=${uuid##luks-}
             if luksname=$(_cryptgetargsname "$uuid="); then
-                luksname="${luksname#$uuid=}"
+                luksname="${luksname#"$uuid"=}"
             else
                 luksname="luks-$uuid"
             fi
@@ -93,7 +93,7 @@ else
 
             serialid=${serialid##luks-}
             if luksname=$(_cryptgetargsname "$serialid="); then
-                luksname="${luksname#$serialid=}"
+                luksname="${luksname#"$serialid"=}"
             else
                 luksname="luks-$serialid"
             fi
@@ -133,7 +133,7 @@ else
 
             luksid=${luksid##luks-}
             if luksname=$(_cryptgetargsname "$luksid="); then
-                luksname="${luksname#$luksid=}"
+                luksname="${luksname#"$luksid"=}"
             else
                 luksname="luks-$luksid"
             fi
diff --git a/modules.d/90dm/dm-shutdown.sh b/modules.d/90dm/dm-shutdown.sh
index 6dbd61758c..bd7134a9ad 100755
--- a/modules.d/90dm/dm-shutdown.sh
+++ b/modules.d/90dm/dm-shutdown.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 _remove_dm() {
-    local dev=$1
+    local dev="$1"
     local s
     local devname
 
@@ -26,7 +26,7 @@ _remove_dm() {
 
 _do_dm_shutdown() {
     local ret=0
-    local final=$1
+    local final="$1"
     local dev
 
     info "Disassembling device-mapper devices"
diff --git a/modules.d/90dmraid/dmraid.sh b/modules.d/90dmraid/dmraid.sh
index d10f42aa8d..b517320a36 100755
--- a/modules.d/90dmraid/dmraid.sh
+++ b/modules.d/90dmraid/dmraid.sh
@@ -26,7 +26,7 @@ if [ -n "$DM_RAIDS" ] || getargbool 0 rd.auto; then
         # only activate specified DM RAIDS
         for r in $DM_RAIDS; do
             for s in $SETS; do
-                if [ "${s##$r}" != "$s" ]; then
+                if [ "${s##"$r"}" != "$s" ]; then
                     info "Activating $s"
                     dmraid -ay -i -p --rm_partitions "$s" 2>&1 | vinfo
                 fi
diff --git a/modules.d/90mdraid/md-shutdown.sh b/modules.d/90mdraid/md-shutdown.sh
index 5562ddb4aa..ca768a9cf9 100755
--- a/modules.d/90mdraid/md-shutdown.sh
+++ b/modules.d/90mdraid/md-shutdown.sh
@@ -2,7 +2,7 @@
 
 _do_md_shutdown() {
     local ret
-    local final=$1
+    local final="$1"
     info "Waiting for mdraid devices to be clean."
     mdadm -vv --wait-clean --scan | vinfo
     ret=$?
diff --git a/modules.d/95lunmask/parse-lunmask.sh b/modules.d/95lunmask/parse-lunmask.sh
index 504c76d863..5e05e5bcc0 100755
--- a/modules.d/95lunmask/parse-lunmask.sh
+++ b/modules.d/95lunmask/parse-lunmask.sh
@@ -3,10 +3,10 @@
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
 create_udev_rule() {
-    local transport=$1
-    local tgtid=$2
-    local lun=$3
-    local _rule=/etc/udev/rules.d/51-${transport}-lunmask-${tgtid}.rules
+    local transport="$1"
+    local tgtid="$2"
+    local lun="$3"
+    local _rule=/etc/udev/rules.d/51-"${transport}"-lunmask-"${tgtid}".rules
 
     [ -e "${_rule}" ] && return 0
 
diff --git a/modules.d/98dracut-systemd/rootfs-generator.sh b/modules.d/98dracut-systemd/rootfs-generator.sh
index e1d365df93..148c1cce7e 100755
--- a/modules.d/98dracut-systemd/rootfs-generator.sh
+++ b/modules.d/98dracut-systemd/rootfs-generator.sh
@@ -44,8 +44,8 @@ EOF
 }
 
 generator_mount_rootfs() {
-    local _type=$2
-    local _flags=$3
+    local _type="$2"
+    local _flags="$3"
     local _name
 
     [ -z "$1" ] && return 0
diff --git a/modules.d/98syslog/rsyslogd-start.sh b/modules.d/98syslog/rsyslogd-start.sh
index 1066893e94..d404e51b3d 100755
--- a/modules.d/98syslog/rsyslogd-start.sh
+++ b/modules.d/98syslog/rsyslogd-start.sh
@@ -11,11 +11,11 @@ if [ -f /var/run/syslogd.pid ]; then
 fi
 
 rsyslog_config() {
-    local server=$1
+    local server="$1"
     shift
-    local syslog_template=$1
+    local syslog_template="$1"
     shift
-    local filters=$*
+    local filters="$*"
     local filter=
 
     cat "$syslog_template"
diff --git a/modules.d/98usrmount/mount-usr.sh b/modules.d/98usrmount/mount-usr.sh
index 43ea0205f9..0a3eb324f5 100755
--- a/modules.d/98usrmount/mount-usr.sh
+++ b/modules.d/98usrmount/mount-usr.sh
@@ -20,9 +20,9 @@ filtersubvol() {
 }
 
 fsck_usr() {
-    local _dev=$1
-    local _fs=$2
-    local _fsopts=$3
+    local _dev="$1"
+    local _fs="$2"
+    local _fsopts="$3"
     local _fsckoptions
 
     if [ -f "$NEWROOT"/fsckoptions ]; then
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index 6963a19bd4..218cb13b91 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -36,6 +36,7 @@ strstr() {
 # An empty $1 will not be considered matched, even if $2 is * which technically
 # matches; as it would match anything, it's not an interesting case.
 strglob() {
+    # shellcheck disable=SC2295
     [ -n "$1" -a -z "${1##$2}" ]
 }
 
@@ -43,6 +44,7 @@ strglob() {
 # An empty $1 will not be considered matched, even if $2 is * which technically
 # matches; as it would match anything, it's not an interesting case.
 strglobin() {
+    # shellcheck disable=SC2295
     [ -n "$1" -a -z "${1##*$2*}" ]
 }
 
@@ -323,7 +325,7 @@ getoptcomma() {
 
     case "${line}" in
         *,${opt}=*,*)
-            tmp="${line#*,${opt}=}"
+            tmp="${line#*,"${opt}"=}"
             echo "${tmp%%,*}"
             return 0
             ;;
@@ -353,10 +355,10 @@ splitsep() {
     local tmp
 
     while [ -n "$str" -a "$#" -gt 1 ]; do
-        tmp="${str%%$sep*}"
+        tmp="${str%%"$sep"*}"
         eval "$1='${tmp}'"
         str="${str#"$tmp"}"
-        str="${str#$sep}"
+        str="${str#"$sep"}"
         shift
     done
     [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
@@ -471,8 +473,8 @@ check_occurances() {
     local expected="$3"
     local count=0
 
-    while [ "${str#*$ch}" != "${str}" ]; do
-        str="${str#*$ch}"
+    while [ "${str#*"$ch"}" != "${str}" ]; do
+        str="${str#*"$ch"}"
         count=$((count + 1))
     done
 
@@ -827,7 +829,7 @@ killproc() {
     debug_off
     local _exe
     _exe="$(command -v "$1")"
-    local _sig=$2
+    local _sig="$2"
     local _i
     [ -x "$_exe" ] || return 1
     for _i in /proc/[0-9]*; do
@@ -891,7 +893,7 @@ if ! command -v pidof > /dev/null 2> /dev/null; then
                 [ "$i" -ef "$_exe" ] || continue
             else
                 _rl=$(readlink -f "$i")
-                [ "${_rl%/$_cmd}" != "$_rl" ] || continue
+                [ "${_rl%/"$_cmd"}" != "$_rl" ] || continue
             fi
             i=${i%/exe}
             echo "${i##/proc/}"
diff --git a/modules.d/99squash/module-setup.sh b/modules.d/99squash/module-setup.sh
index 81311d3a84..dc2e0a2059 100755
--- a/modules.d/99squash/module-setup.sh
+++ b/modules.d/99squash/module-setup.sh
@@ -30,7 +30,7 @@ installpost() {
     # so dracut rebuild and lsinitrd can work
     for file in "$squash_dir"/usr/lib/dracut/*; do
         [[ -f $file ]] || continue
-        DRACUT_RESOLVE_DEPS=1 dracutsysrootdir="$squash_dir" inst "${file#$squash_dir}"
+        DRACUT_RESOLVE_DEPS=1 dracutsysrootdir="$squash_dir" inst "${file#"$squash_dir"}"
     done
 
     # Install required modules and binaries for the squash image init script.
diff --git a/test/TEST-20-NFS/server-init.sh b/test/TEST-20-NFS/server-init.sh
index 743f1d3e77..6abe82662a 100755
--- a/test/TEST-20-NFS/server-init.sh
+++ b/test/TEST-20-NFS/server-init.sh
@@ -37,7 +37,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/test/TEST-30-ISCSI/server-init.sh b/test/TEST-30-ISCSI/server-init.sh
index fd5538d860..a1c3b7ee90 100755
--- a/test/TEST-30-ISCSI/server-init.sh
+++ b/test/TEST-30-ISCSI/server-init.sh
@@ -36,7 +36,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/test/TEST-35-ISCSI-MULTI/server-init.sh b/test/TEST-35-ISCSI-MULTI/server-init.sh
index fd5538d860..a1c3b7ee90 100755
--- a/test/TEST-35-ISCSI-MULTI/server-init.sh
+++ b/test/TEST-35-ISCSI-MULTI/server-init.sh
@@ -36,7 +36,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/test/TEST-40-NBD/server-init.sh b/test/TEST-40-NBD/server-init.sh
index 729d6a8040..bc52b2e662 100755
--- a/test/TEST-40-NBD/server-init.sh
+++ b/test/TEST-40-NBD/server-init.sh
@@ -36,7 +36,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/test/TEST-50-MULTINIC/server-init.sh b/test/TEST-50-MULTINIC/server-init.sh
index 7dcb256622..91db7ae765 100755
--- a/test/TEST-50-MULTINIC/server-init.sh
+++ b/test/TEST-50-MULTINIC/server-init.sh
@@ -37,7 +37,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done
diff --git a/test/TEST-60-BONDBRIDGEVLANIFCFG/client-init.sh b/test/TEST-60-BONDBRIDGEVLANIFCFG/client-init.sh
index 644308d134..b0851116ca 100755
--- a/test/TEST-60-BONDBRIDGEVLANIFCFG/client-init.sh
+++ b/test/TEST-60-BONDBRIDGEVLANIFCFG/client-init.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 exec > /dev/console 2>&1
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
-strstr() { [ "${1#*$2*}" != "$1" ]; }
+strstr() { [ "${1#*"$2"*}" != "$1" ]; }
 CMDLINE=$(while read -r line; do echo "$line"; done < /proc/cmdline)
 export TERM=linux
 export PS1='initramfs-test:\w\$ '
diff --git a/test/TEST-60-BONDBRIDGEVLANIFCFG/server-init.sh b/test/TEST-60-BONDBRIDGEVLANIFCFG/server-init.sh
index ea06b787e0..c125d0f4a3 100755
--- a/test/TEST-60-BONDBRIDGEVLANIFCFG/server-init.sh
+++ b/test/TEST-60-BONDBRIDGEVLANIFCFG/server-init.sh
@@ -39,7 +39,7 @@ wait_for_route_ok() {
     local cnt=0
     while [ $cnt -lt 200 ]; do
         li=$(ip route show)
-        [ -n "$li" ] && [ -z "${li##*$1*}" ] && return 0
+        [ -n "$li" ] && [ -z "${li##*"$1"*}" ] && return 0
         sleep 0.1
         cnt=$((cnt + 1))
     done