Ignoring your actual code, if you're going to be passing user specified code to the command line, use quotemeta. It was designed for this. But preferably, use the LIST form of system or open and avoid the shell entirely.