Use escapeshellarg() on the query string passed to shell_exec()

Use `escapeshellarg()` on the query string passed to `shell_exec()`, to make sure its treated safely as a single argument.