You might filtering $user and $password through quotemeta before handing them off to the shell.