Fix bash coding practices

Fix a couple low-hanging-fruit issues is shell script, most notably quoting all variables that come from external input.