Neither , nor : is special for /bin/sh:

perl -wle 'system("echo ab,:cd")'
prints:
ab,:cd
[download]

So something else is the cause, but we can't know what since you don't give us enough information to reproduce your problem (mind you, using the list form of system/exec/whatever is still a good idea, but not using that or bad escaping is probably not the cause). Do you maybe have a non-standard IFS environment variable?