only escape command arguments and not the command itself

Otherwise, prefixing a command with exec (see #5759 why you would do that) would lead to a "Command not found error".
introduce new helper commands for PHP's built-in server