Quote shell argument with escapeshellarg()

Currently, the call to "scp -t" or "scp -f" just uses naive quoting - i.e. a couple of quote marks are thrown in.

But, this can easily be escaped from - if the filename has a quote mark of its own in it, for example.

e.g. if the filename is as follows, then bad things will happen:

 ";rm -rf /

Instead, escapeshellarg should be used, to make sure it gets escaped properly.