You can use the multi-arg version of `system`, which avoids the problems of shell expansion.
```ruby
args = []
if viewonly
  args.push "-viewonly"
end
args.push "#{vlhost}::#{vlport}"
system("vncviewer", *args)
```