title: How to avoid cmd.exe interpreting shell special characters like < > ^
body: <p>I have a Windows CMD script that accepts a number of parameters and executes an EXE, passing first some hard-coded arguments and then all of the parameters from the user. The CMD script looks like this:</p>
  
  <pre><code>launcher.exe paramX paramY %*
  </code></pre>
  
  <p>The user would execute the CMD script from the Windows shell as follows:</p>
  
  <pre><code>launcher.cmd param1 param2 param3 [...]
  </code></pre>
  
  <p>The problem I have is that if the parameters to the CMD script contain shell special characters like <code>&lt;</code> <code>&gt;</code> and <code>^</code>, the user is forced to escape these by preceding each with 3 caret <code>^</code> shell escape characters.</p>
  
  <h2>Two Examples</h2>
  
  <p>1) To pass the argument <code>ten&gt;one</code> to the EXE, the user must launch the CMD as follows:</p>
  
  <pre><code>launcher.cmd ten^^^&gt;one
  </code></pre>
  
  <p>The reason for this is that the shell special characters <code>^</code> and <code>&gt;</code> are interpreted by the command shell at two levels, first on the command line and second inside the CMD script. So, the shell escaping with the caret <code>^</code> shell escape character must be applied twice. The problem is that this is non-obvious to the user and looks ugly. </p>
  
  <p>For this example, a nicer solution is to surround the argument with double quotes. However, this breaks down for more complex examples that include a literal double quote in the argument.</p>
  
  <p>2) To pass the argument <code>"^</code> to the EXE, the user must launch the CMD as follows:</p>
  
  <pre><code>launcher.cmd "\"^^^^"
  </code></pre>
  
  <p>In my case I want to support arguments that contain <em>any</em> sequence of low ASCII characters, excluding control characters, i.e. code points 0x20 to 0x7E. I understand that there will be examples where the user will have to escape certain shell special characters with a caret. However, I <em>don't</em> want the user to have to use <strong>3</strong> carets every time in these cases just because they happen to be calling a CMD script instead of an EXE.</p>
  
  <p>I can solve this problem by replacing the CMD script with an EXE that does the same. However, is there any way to alter the CMD script so that it passes its parameters through to the EXE without interpreting the shell special characters?</p>