Or for a non-security-problem-way, use spawnvp(), which won't have problems with spaces and/or weird quotes and/or mistaking commands for environment variables / bash commands / .... like system() does.