Use escapeshellarg to prevent code execution

Without escapeshellarg someone could use ``$pin = '; sudo rm -rf /';`` or something similar.