Use escapeshellcmd

escapeshellcmd is the correct function for preventing command-line injections.  You may also want to use urlencode() if you want to limit to only youtube.com, and not allow other video sites.