Sanitize batch inputs against quotation marks? - windows

Question

Rem ask for user input
set /p installerchoice= Please enter number for installer you wish to use:
Rem check to make sure input is a number
SET "var="&for /f "delims=0123456789" %%n in ("%installerchoice%") do set "var=%%n"
if defined var Goto Choose
rem check to make sure input is not zero
if %installerchoice% equ 0 goto Choose
rem check to make sure input isn't to high
if %installerchoice% gtr %Count% goto Choose
lection=%%i
I'm trying to make sure a valid input (a numerical value between 1 and how ever many options there are) is input. The only thing that seems to cause a problem right now is if a " is entered. Is there anyway to prevent that from crashing the bat?

Answer 1

Here's how I'd tackle the task in your code:
:Choose
#Set "InstallerChoice="
#Set /P "InstallerChoice=Please enter the number for the installer you wish to use: "
#SetLocal EnableDelayedExpansion
#(Echo(!InstallerChoice!|"%__AppDir__%findstr.exe" /RX "[123456789][0123456789]* 0">NUL||(EndLocal&Goto Choose)) 2>NUL
#EndLocal
#Echo Your number %InstallerChoice% is valid.
#Pause
However, had you provided the rest of the code, which I assume has parsed a directory within a for loop and allocated filenames to numbers in a menu like manner, there may have been a better or different methodology.

Answer 2

For Single Digit input, Use Choice
CHOICE /N /C 123456789 /M "Select Installer Number 1 2 3 4 5 6 7 8 9"
GOTO :installer%errorlevel%
And use labels for your Installers such as:
:installer1
::commands
:installer2
::commands
To offer More options and Flexibility, Make Use of an Input Validation Function
#ECHO OFF
::: REM Delayed expansion is required only for testing of Second Call Parameter
::: Is not required if that testing is removed.
SETLOCAL EnableDelayedExpansion
::: REM The below 6 lines allow testing of the function, and are not part of the function.
:start
cls
CALL :Filter option number
ECHO %option%
pause
GOTO :start
:::::::::::::::::::::::::::::: Function by T3RRY
::: Using this Function-
::: When Needing User Input:
:::
::: CALL :Filter <VarName> <AllowType>
::: Where <VarName> is replaced with the Variable name to be Set
::: And <AllowType> is replaced with letter, number, or alphanumerical
:Filter
::: Assign the variable (Passed by call Argument) to be set and tested
SET "testinput=%1"
SET "permitted=%~2"
::: Test Parameter Usage is Correct- For Debugging Only.
IF NOT DEFINED testinput (
ECHO Improper use of Filter Function. CALL :Filter must include a Parameter to define the Variable to be Set
Pause
Exit
)
Set P_True=0
IF DEFINED permitted (
IF /I "%permitted%"=="number" Set /a P_True+=1
IF /I "%permitted%"=="letter" Set /a P_True+=1
IF /I "%permitted%"=="alphanumerical" Set /a P_True+=1
IF "!P_True!"=="0" (
ECHO Incorrect Parameter used for CALL :Filter 2nd Call Parameter.
ECHO Parameter may be undefined, If Defined must include "number" OR "letter" OR "alphanumerical"
Pause
Exit
)
)
::: Expand testinput to the Name of the Variable to be Assigned, Ensures Undefined
SET %testinput%=
::: Ensure Undefined Value for Input
SET input=
:Get_Input
::: Exit Filter once Acceptable Variable is Set
IF DEFINED input GOTO return
::: Create and start VBS script to Launch an Input Box and Store the input to text file for retrieval from this Batch program.
SET /P input=[Select %testinput%:]
::: Test to ensure Variable defined. Needed here to prevent environment variable not defined message ahead of next test Should the variable not be defined.
IF NOT DEFINED input GOTO invInput
::: Test for Doublequotes and reset variable if present
SET Input | FIND """" >NUL
IF NOT ERRORLEVEL 1 SET Input=
IF NOT DEFINED input GOTO invInput
:: REM Block Tilde
SET Input | FIND "~" >NUL
IF NOT ERRORLEVEL 1 SET Input=
IF NOT DEFINED input GOTO invInput
::: Test for Spaces
IF NOT "%input%"=="%input: =%" GOTO invInput
::: Test for all other standard Symbols.
::: To permit symbols REM out permitted Symbol and Call Filter without Second Parameter.
IF NOT "%input%"=="%input:&=%" GOTO invInput
IF NOT "%input%"=="%input:(=%" GOTO invInput
IF NOT "%input%"=="%input:)=%" GOTO invInput
IF NOT "%input%"=="%input:<=%" GOTO invInput
IF NOT "%input%"=="%input:>=%" GOTO invInput
IF NOT "%input%"=="%input:{=%" GOTO invInput
IF NOT "%input%"=="%input:}=%" GOTO invInput
IF NOT "%input%"=="%input:]=%" GOTO invInput
IF NOT "%input%"=="%input:[=%" GOTO invInput
IF NOT "%input%"=="%input:#=%" GOTO invInput
IF NOT "%input%"=="%input:^=%" GOTO invInput
IF NOT "%input%"=="%input:+=%" GOTO invInput
IF NOT "%input%"=="%input:-=%" GOTO invInput
IF NOT "%input%"=="%input:/=%" GOTO invInput
IF NOT "%input%"=="%input:\=%" GOTO invInput
IF NOT "%input%"=="%input:|=%" GOTO invInput
IF NOT "%input%"=="%input:$=%" GOTO invInput
IF NOT "%input%"=="%input:!=%" GOTO invInput
IF NOT "%input%"=="%input:?=%" GOTO invInput
IF NOT "%input%"=="%input:#=%" GOTO invInput
IF NOT "%input%"=="%input:'=%" GOTO invInput
IF NOT "%input%"=="%input:,=%" GOTO invInput
IF NOT "%input%"=="%input:.=%" GOTO invInput
IF NOT "%input%"=="%input:;=%" GOTO invInput
IF NOT "%input%"=="%input:`=%" GOTO invInput
:: REM Length restriction. Adjust the length (Number) or Rem out as Desired
::: IF NOT "%input:~12%"=="" GOTO invInput
IF NOT DEFINED permitted GOTO :Get_Input
IF /I "%permitted%"=="number" GOTO :P_numbers
IF /I "%permitted%"=="letter" GOTO :P_letters
IF /I "%permitted%"=="alphanumerical" GOTO :P_alphanumerical
::: REM Permit only Numbers, Letters, or Letters and Numbers. Also Blocks *,! and %
:P_numbers
echo.%input%| findstr /R "[^0-9]" >nul 2>nul
if NOT errorlevel 1 GOTO invInput
GOTO :Get_Input
:P_letters
echo.%input%| findstr /R "[^a-zA-Z]" >nul 2>nul
if NOT errorlevel 1 GOTO invInput
GOTO :Get_Input
:P_alphanumerical
echo.%input%| findstr /R "[^a-zA-Z0-9]" >nul 2>nul
if NOT errorlevel 1 GOTO invInput
GOTO :Get_Input
:invInput
SET input=
::: REM Specifies the permitted input types.
IF DEFINED permitted (
ECHO Input of %permitted% characters is allowed. Other Symbols and Characters are Not Permitted.
) else (
ECHO Invalid Character Entered. Try Again
)
GOTO :Get_Input
:return
::: assigns the input value to the variable name being validated.
SET "%testinput%=%input%"
SET input=
GOTO :EOF

Answer 3

The solution is quite simple: just enable delayed variable expansion before the for /F loop and use it for variable !InstallerChoice!, then any " the user enters is no longer recognised by the parser:
:Choose
set "InstallerChoice=" & rem // (reset variable to avoid keeping previous value)
set /P InstallerChoice="Please enter number for installer you wish to use: "
rem // Check to make sure input is a number:
set "var=" & setlocal EnableDelayedExpansion
for /F "eol=0 delims=0123456789" %%N in ("!InstallerChoice!") do set "var=%%N"
if defined var (endlocal & Goto Choose) else endlocal
rem // Check to make sure input is not zero:
if %InstallerChoice% equ 0 goto Choose
rem // Check to make sure input isn't to high:
if %InstallerChoice% gtr %Count% goto Choose
By the way, let me recommend to put set "InstallerChoice=" just before set /P, because when the user just presses {Enter}, the previous value is going to be kept otherwise.
And you should add eol=0 to the for /F loop options to not come into trouble when the user enters something beginning with the default eol character ;.