Fix setting property values with spaces

`shellescape` was also escaping spaces, which
wasn’t quite right. This change instead only
escapes particular characters.