Just escaping shell arguments

Possibly solution for the who.is server exploit. Untested.