Make sure to quote all potentially user-supplied values