Use escapeshellarg

This is important to not be sad if someone has a $_GET['device'] = '; sudo rm -rf /';
Merge pull request #1 from runjak/master

Thanks runjak, this is definitely important. We didn't initially add any security since we were only running in a controlled demo environment, but this is good to have in case someone wants to build on this code.