Whoa. Am I right in thinking that the proper fix would be not to use the system() function in the first place, so that you don't have to guess the escaping rule

Whoa. Am I right in thinking that the proper fix would be not to use the system() function in the first place, so that you don't have to guess the escaping rules of whatever shell the user happens to be using?