properly escape spaces, quotes, etc. in filenames