only escape urls
use correct shell instance