escape filenames when building commands

[notxarb]

Resolves issue #10

[danhunsaker]

I remember seeing other places in the repo where shell escapes would be a good plan, though I don't recall where they all were. If I'm not misremembering these, it might be a good plan to escape those while you're at it...