escape shell args, thanks @dpiddy