Use escapeshellcmd

escapeshellcmd is the correct function for preventing command-line injections.  You may also want to use urlencode() if you want to limit to only youtube.com, and not allow other video sites.
Merge pull request #1 from iggyvolz/patch-1

Use escapeshellcmd; thanks to iggyvolz