core: fix security issue.

Escape arguments passed to external plugins.

Fixes #61, Fixes #12.
Merge pull request #62 from kaos/master

Fix security issue reported earlier today...