Correct - the escaped password will be $$foo$$ or some such whereas the actual password needs to be passed as the environment variable.