In Lua, a string literal is exactly and only that string. Strings don't know anything about variables, the global environment, local variables, etc. They're just strings. The string "filename" in Lua will always be a string of 8 characters. It will not go out and try to find a variable named filename and extract something from it.
What you want is to build a string, from multiple strings. Part of the string will come from literals, and part will come from a variable. Lua has several tools for that. The simplest is the .. concatenation operator:
[["C:\Sox\sox.exe" -S ]] .. filename .. [[ -r 22050 C:\Sox\SoX_out.wav]]
This builds a new string from a string literal, the contents of the filename variable, and another string literal. The spaces you see at the end of the first literal and the beginning of the second are necessary, since Lua will not insert spaces between the two concatenated pieces.
For more complex cases, it's useful to just build a table of parameters and use table.concat to build a string out of them:
local params =
{
[[C:\Sox\sox.exe]],
"-S",
filename,
"-r 22050",
[[C:\Sox\SoX_out.wav]]
}
os.execute(table.concat(params, " "))
Note the lack of spaces in the string literals. This is because table.concat's second parameter is a string to be inserted between the entries in the array. So between each array element will be a space; we don't need to manually add them.
os.execute([[""C:\Sox\sox.exe" -S "]]..filename..[[" -r 22050 "]]..filename2..[[""]])