{"id":2621,"date":"2011-06-03T08:43:00","date_gmt":"2011-06-03T08:43:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/powershell\/2011\/06\/03\/invoke-expression-considered-harmful\/"},"modified":"2019-02-18T13:05:47","modified_gmt":"2019-02-18T20:05:47","slug":"invoke-expression-considered-harmful","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/invoke-expression-considered-harmful\/","title":{"rendered":"Invoke-Expression considered harmful"},"content":{"rendered":"<p>The PowerShell team frequently gets questions that start out &ldquo;how do I get the quoting right for&hellip;&rdquo; and the answer turns out to usually be &ndash; there is a simpler way &ndash; don&rsquo;t use Invoke-Expression.<\/p>\n<p>The problem arises when trying to run some command external to PowerShell.&nbsp; Some common reasons people try Invoke-Expression:<\/p>\n<ul>\n<li>running some command with a space in the path<\/li>\n<li>some command takes an argument with characters that have special meaning in PowerShell, e.g. curly braces (&lsquo;{&lsquo; and &lsquo;}&rsquo;)<\/li>\n<li>some command argument needs to use a PowerShell variable, perhaps as part of a quoted argument<\/li>\n<\/ul>\n<p>If you&rsquo;re just running some command external to PowerShell (exe, cmd, etc.) and you&rsquo;re using Invoke-Expression, you are just making things more difficult than you need to.<\/p>\n<p>So what&rsquo;s wrong with Invoke-Expression then?<\/p>\n<ul>\n<li>It complicates getting quoting right<\/li>\n<li>It makes maintaining your script harder<\/li>\n<li>It&rsquo;s slower than the alternatives<\/li>\n<li>And maybe worst of all &ndash; it opens up a script to code injection attacks<\/li>\n<\/ul>\n<p>If Invoke-Expression isn&rsquo;t the right way &ndash; then what is?<\/p>\n<p>If you&rsquo;re running some command and the command path has spaces in it, then you need the command invocation operator &lsquo;&amp;&rsquo; (see help about_operators, look for &ldquo;call operator&rdquo;).<\/p>\n<p>If your command runs, but your arguments are wrong, then there is a good chance you are getting the quotes wrong.&nbsp; Invoke-Expression doesn&rsquo;t help at all in this case, it just makes the problem more complicated.&nbsp;<\/p>\n<p>The bottom line: Invoke-Expression is a powerful and useful command for some scenarios such as creating new scripts at runtime, but in general, if you find yourself using Invoke-Expression, you should ask yourself, or maybe a respected colleague if there is a better way.<\/p>\n<p>Jason Shirk <br \/>Windows PowerShell Team<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The PowerShell team frequently gets questions that start out &ldquo;how do I get the quoting right for&hellip;&rdquo; and the answer turns out to usually be &ndash; there is a simpler way &ndash; don&rsquo;t use Invoke-Expression. The problem arises when trying to run some command external to PowerShell.&nbsp; Some common reasons people try Invoke-Expression: running some [&hellip;]<\/p>\n","protected":false},"author":600,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell"],"acf":[],"blog_post_summary":"<p>The PowerShell team frequently gets questions that start out &ldquo;how do I get the quoting right for&hellip;&rdquo; and the answer turns out to usually be &ndash; there is a simpler way &ndash; don&rsquo;t use Invoke-Expression. The problem arises when trying to run some command external to PowerShell.&nbsp; Some common reasons people try Invoke-Expression: running some [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/2621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/600"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=2621"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/2621\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=2621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=2621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=2621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}