going with shell=True, considering vulnerability checking another time,
need to sanitize input