use quotemeta (as adviced in RT-99748) to address serious security issues