Command line escaping single quote for PowerShell

cmd, escaping, powershell

Solution

This is actually a lot trickier than you'd think. Escaping nested quotes in strings passed from cmd to PowerShell is a major headache. What makes this one especially tricky is that you need to make the replacement in a variable expanded by cmd in the quoted argument passed to powershell.exe within a single-quoted argument passed to a PowerShell script parameter. AFAIK cmd doesn't have any native functionality for even basic string replacements, so you need PowerShell to do the replacement for you.

If the argument to the -data paramater (the one contained in the cmd variable x) doesn't necessarily need to be single-quoted, the simplest thing to do is to double-quote it, so that single quotes within the value of x don't need to be escaped at all. I say "simplest", but even that is a little tricky. As Vasili Syrakis indicated, `^` is normally the escape character in cmd, but to escape double quotes within a (double-)quoted string, you need to use a `\`. So, you can write your batch command like this:

`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass "G:\test.ps1 -name \"%x%\" -data '%y%'"`

That passes the following command to PowerShell:

G:\test.ps1 -name "value of x, which may contain 's" -data 'value of y'

If, however, x can also contain characters that are special characters in PowerShell interpolated strings (`"`, `$`, or

'foo'bar' -replace "'", "''"

On the other hand, if you double-quote it, then PowerShell interpolates the string before it performs any replacements on it, so if it contains any special characters, they're interpreted before they can be escaped by a replacement. I searched high and low for other ways to quote literal strings inline (something equivalent to perl's q//, in which nothing needs to be escaped but the delimiter of your choice), but there doesn't seem to be anything.

So, the only solution left is to use a here string, which requires a multi-line argument. That's tricky in a batch file, but it can be done:

setlocal EnableDelayedExpansion set LF=^

set pscommand=G:\test.ps1 -name @'!LF!!x!!LF!'@ -data '!y!' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass "!pscommand!"

This assumes that x and y were set earlier in the batch file. If your app can only send a single-line command to cmd, then you'll need to put the above into a batch file, adding the following two lines to the beginning:

set x=%~1 set y=%~2

Then invoke the batch file like this:

path\test.bat "%x%" "%y%"

The `~` strips out the quotes surrounding the command line arguments. You need the quotes in order to include spaces in the variables, but the quotes are also added to the variable value. Batch is stupid that way.

The two blank lines following `set LF=^` are required.

That takes care of single quotes which also interpreting all other characters in the value of x literally, with one exception: double quotes. Unfortunately, if double quotes may be part of the value as you indicated in a comment, I don't believe that problem is surmountable without the use of a third party utility. The reason is that, as mentioned above, batch doesn't have a native way of performing string replacements, and the value of x is expanded by cmd before PowerShell ever sees it.

BTW...GOOD QUESTION!!

UPDATE:

In fact, it turns out that it is possible to perform static string replacements in cmd. Duncan added an answer that shows how to do that. It's a little confusing, so I'll elaborate on what's going on in Duncan's solution.

The idea is that `%var:hot=cold%` expands to the value of the variable var, with all occurrences of `hot` replaced with `cold`:

D:\Scratch\soscratch>set var=You're such a hot shot!

D:\Scratch\soscratch>echo %var% You're such a hot shot!

D:\Scratch\soscratch>echo %var:hot=cold% You're such a cold scold!

So, in the command (modified from Duncan's answer to align with the OP's example, for the sake of clarity):

powershell G:\test.ps1 -name '%x:'=''%' -data '%y:'=''%'

all occurrences of `'` in the variables x and y are replaced with `''`, and the command expands to

powershell G:\test.ps1 -name 'a''b' -data 'c''d'

Let's break down the key element of that, `'%x:'=''%'`:

- The two `'`s at the beginning and the end are the explicit outer quotes being passed to PowerShell to quote the argument, i.e. the same single quotes that the OP had around `%x`

- `:'=''` is the string replacement, indicating that `'` should be replaced with `''`

- `%x:'=''%` expands to the value of the variable x with `'` replaced by `''`, which is `a''b`

- Therefore, the whole thing expands to `'a''b'`

This solution escapes the single quotes in the variable value much more simply than my workaround above. However, the OP indicated in an update that the variable may also contain double quotes, and so far this solution still doesn't pass double quotes within x to PowerShell--those still get stripped out by cmd before PowerShell receives the command.

The good news is that with the cmd string replacement method, this becomes surmountable. Execute the following cmd commands after the initial value of x has already been set:

Replace `'` with `''`, to escape the single quotes for PowerShell:

set x=%x:'=''%

Replace `"` with `\"`, to escape the double quotes for cmd:

set x=%x:"=\"%

The order of these two assignments doesn't matter.

Now, the PowerShell script can be called using the syntax the OP was using in the first place (path to powershell.exe removed to fit it all on one line):

powershell.exe -ExecutionPolicy Bypass "G:\test.ps1 -name '%x' -data '%y'"

Again, if the app can only send a one-line command to cmd, these three commands can be placed in a batch file, and the app can call the batch file and pass the variables as shown above (first bullet in my original answer).

One interesting point to note is that if the replacement of `"` with `\"` is done inline rather than with a separate set command, you don't escape the `"`s in the string replacement, even though they're inside a double-quoted string, i.e. like this:

powershell.exe -ExecutionPolicy Bypass "G:\test.ps1 -name '%x:"=\"' -data '%y'"

...not like this:

powershell.exe -ExecutionPolicy Bypass "G:\test.ps1 -name '%x:\"=\\"' -data '%y'"

Problem

Original source