If you don't pass it as a list, you're asking the shell to interpret the line, which means 1) You're running an extra program (which is probably no biggie), and 2) you need to be wary of injection attacks. Be sure to validate any text sent as arguments to the child.