title: Escaping command parameters passed to xp_cmdshell to dtexec
body: <p>I am calling an SSIS package remotely using a stored procedure and a call to xp_cmdshell:</p>
  
  <pre><code>declare @cmd varchar(5000)
  set @cmd = '"C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\dtexec.exe" /Rep E /Sql Package /SET \Package.Variables[User::ImportFileName].Value;c:\foo.xlsx'
  print @cmd
  exec xp_cmdshell @cmd
  </code></pre>
  
  <p>This works fine, however I can not guarantee the variable value (c:\foo.xslx) is not going to contain spaces so I would like to escape that with quotes like below:</p>
  
  <pre><code>set @cmd = '"C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\dtexec.exe" /Rep E /Sql Package /SET \Package.Variables[User::ImportFileName].Value;"c:\foo.xlsx"'
  </code></pre>
  
  <p>But by doing this I get the error </p>
  
  <pre><code>'C:\Program' is not recognized as an internal or external command, operable program or batch file.
  </code></pre>
  
  <p>Both of the above commands work fine if executed within cmd.exe so I am guessing that SQL Server is interpreting my double quotes and changing something, but I can't figure out what.</p>