[ENH] proper shell quoting

Not sure if this is windows compatible. I'd prefer to use .spawn()'s
args array, but can't get the existing tests to pass on my machine,
so I tried to change as little as possible to not break it.

For same reasons, I couldn't add a test for shell command injection,
but it looks like supplying an evil filename would most probably work.