quote variables which might contain weird stuff