Escape filenames and arguments in system()