Avoid passing untrusted strings to the shell

Use the subprocess.call() method instead.