Quote all variables.

This should prevent unintended expansion.