make sure we only shellescape strings, not numbers