You don't have to do anything at all.

system('tar', 'cvzf', 'my_tarball.tgz', $path);
[download]

Again, the multi-arg form of system does not invoke the shell, so you can pass all the spaces, quotes and dollars signs you want and no shell will touch them.