I see a gaping security hole. You are passing strings from the wild directly to a command line which is interpreted by the shell. Fixing that will probably fix your stated problem, too.