turn off shell=True, to prevent injection