Use escapeshellarg

This is important to not be sad if someone has a $_GET['device'] = '; sudo rm -rf /';