use shellescape() to escape arguments to system()

Closes #15.