Comparison Operators


PowerShell has several types of comparison operators that you can use to evaluate expressions. These operators are listed in Table 6.7.

image from book
Table 6.7: PowerShell Comparison Operators
Open table as spreadsheet

Operator

Description

Algebraic Equivalent

-eq

Equals

A=B

-ne

Not equal

A<>B

-gt

Greater than

A>B

-ge

Greater than or equal to

A>=B

-lt

Less than

A<B

-le

Less than or equal to

A<=B

image from book

You are probably familiar with most of these operators or at least their algebraic equivalent. In PowerShell, these operators are used to evaluate an expression and return either TRUE or FALSE.

 PS C:\> $varA=100 PS C:\> $varB=200 PS C:\> $varA -eq $varB False PS C:\> $varA -ne $varB True PS C:\> $varA -lt $varB True PS C:\> 

After we define some variables, we compare them with a few of the comparison operators that return either TRUE or FALSE.

These comparison operators work just fine for simple numeric comparisons. For string comparisons we can use -like and -match. If your comparison needs are simple, the -like operator may be all you need:

 PS C:\> "10.10.10.1" -like "10.10.10.*" True PS C:\> "10.10.10.25" -like "10.10.10.*" True PS C:\> "10.10.11.1" -like "10.10.10.*" False PS C:\> 

In this example we're comparing an IP address (10.10.10.1) to a pattern that uses the wildcard character (*). This comparison returns the Boolean value TRUE. The second comparison also matches, but the third fails. The operator returns FALSE because the third octet no longer matches the pattern.

Depending on the logic of your script, you may want to check the inverse. In other words, you may want to determine if the address is not like the pattern. For an inverse type of comparison use the -notlike operator.

 PS C:\> "10.10.11.1" -notlike "10.10.10.*" True PS C:\> 

This is essentially the same comparison, except this operator returns TRUE because 10.10.11.1 is not like 10.10.10.*.

The asterisk is a multiple character wildcard that can be used if we need something more granular. For example, we can use the "?" operator if we want to match any subnet of 10.10.10.x to 10.10.19.x.

 PS C:\> "10.10.11.1" -like "10.10.1?.*" True PS C:\> "10.10.15.1" -like "10.10.1?.*" True PS C:\> "10.10.25.1" -like "10.10.1?.*" False PS C:\> 

In this example you can see the first two comparisons are TRUE, but the last one does not meet the pattern so it returns FALSE.

Text Comparison Only

Make sure you understand the IP address comparisons are merely looking at the IP address string. We are not calculating or comparing network address with subnet masks or the like.

Let's look at some text comparison examples.

 PS C:\> "sapien" -like "SAPIEN" True PS C:\> "sapien" -like "sap*" True PS C:\> "sapien" -like "sap?" False PS C:\> "sapien" -like "sapie[a-p]" True PS C:\> 

The first example is a pretty basic comparison that also demonstrates that the -like operator is not case-sensitive. The second example uses the wildcard character, which means it will return TRUE for a string like "sapien". However, it will also return TRUE for "sapsucker" and "sapling". The third example returns FALSE because the "?" character means any single character after "sap". The last example is a bit different. We can use brackets to denote a range of characters with which to compare. In this case, the -like operator will return TRUE for anything that starts with "sapie" and ends with any character between a and p.

The -like operator limits your comparisons essentially to a few wildcards. If you need something that will compare a pattern, then use the -match operator. This operator also returns TRUE if the string matches the specified pattern.

At it's simplest, -match returns TRUE if any part of the string matches the pattern:

 PS C:\> $var="XPDesktop01" PS C:\> $var -match "XP" True PS C:\> $var -match "desk" True PS C:\> $var -match "01" True PS C:\> 

In this example we set a variable to the value "XPDesktop01" and compared it with a variety of patterns using -match. As you can see, they all return TRUE because pattern such as "desk" exist somewhere in the string. However, sometimes we need to be more particular such as only returning TRUE if the name starts with "XP". In this case, we can use "^" to indicate we want to match the beginning characters:

 PS C:\> $var -match "^XP" True PS C:\> $var -match "^Win2K" False PS C:\> 

If we want to match something at the end of the string, then we use the $ character:

 PS C:\> $var -match "01$" True PS C:\> $var -match "02$" False PS C:\> 

In the first example, we get a positive match because $var, which is XPDesktop01, ends in 01. The second attempt is FALSE because $var does not end in 02.

Other times we may be looking for something in between such as a range of characters. In this case, we can use brackets and match anything that falls within the range:

 PS C:\> "hat" -match "h[aeiou]t" True PS C:\> "hit" -match "h[aeiou]t" True PS C:\> "hyt" -match "h[aeiou]t" False PS C:\> 

In this example "hat" and "hit" match the pattern because the middle character is included in the bracketed set. The last example fails to match because "y" is not in the set.

One final comment on -match is that the matching results are automatically stored in an array called $matches:

 PS C:\> "CHI-SRV-02" -match "^chi" True PS C:\> $matches Name                           Value ----                           ----- 0                              CHI PS C:\> "NYD-SRV-03" -match "^NY[a-d]" True PS C:\> $matches Name                           Value ----                           ----- 0                              NYD PS C:\> 

In the first example the match pattern is looking for a string that begins with "chi". Since the string includes "chi", it returns TRUE. The $matches array is automatically populated with the matching text. In the second example we're looking for something that starts with NY and the third character can be a, b, c, or d. The $matches array shows us that NYD matched.

The 0 element of the array always returns the matched string. However, it is also possible to group results and save them as named groups:

 PS C:\> "Computer system=XPDesk02" -match "^comp.*=(?<sysname>.*)" True PS C:\> $matches Name                           Value ----                           ----- sysname                        XPDesk02 0                              Computer system=XPDesk02 PS C:\> $matches.sysname XPDesk02 PS C:\> 

In this example we have a string, "Computer system=XPDesk02" that is being matched against a pattern that will match up with "Computer system=". To create a named group, we enclose the name of our group in parentheses. In this case, sysname and a matching pattern (.*) will be enclosed in parentheses. The syntax for defining the named group is ?<name>. If we have a match, then the $matches array will not only have element 0, but also our named element sysname. Until we use -match again, this array remains intact, and we can get the sysname property with dotted notation as we did with $matches.sysname in the example above.

Almost all of our examples have been fairly basic and theoretical. Here's an example of how we might use -match in a production setting:

 PS C:\> $sys=get-wmiobject -class "win32_computersystem" PS C:\> $sys.name XPDESK01 PS C:\> if ($sys.name -match "^xp") { >> write-host "Running audit code" >> #audit code can run here >> } >> else >> { >> write-host "Skipping system" >> } >> Running audit code PS C:\> 

This code could be part of a larger script. Essentially it sets the variable $sys to an instance of the Win32_ComputerSystem WMI object. We're displaying the object's name property so you'll understand how the rest of the code works. Next we build an IF statement that says "if the name property starts with XP, then display a message and run something. Otherwise, just display a message that the system is being skipped". At this point do not be concerned about understanding the IF statement since it will be covered in Chapter 8. As you see, the name matches so the appropriate message is displayed.

The -match operator is also used with regular expressions, which will be discussed in Chapter 7.



Windows PowerShell. TFM
Internet Forensics
ISBN: 982131445
EAN: 2147483647
Year: 2004
Pages: 289

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net