If you just want to execute a program rather then a shell command, then you can use the multiple argument form of either, and you won't have to worry about escaping.

system('cat foo bar');     # Cats 'foo' and 'bar'
system('cat', 'foo bar');  # Cats 'foo bar'

system('some command');                     # Executes 'some'
system({ 'some command' } 'some command');  # Executes 'some command'
[download]

Some escapes aren't possible in Windows, so avoid " and control characters.

Depends on what you need to do.

system ne exec

So, we'll need a bit more information.

If your objective is to use the users search path, obviously you have to avoid giving absolute paths, instead you just have to give the name of the executable. Since you have only one choice in this regard, best practice == the one and only practice.