Index: modules/htmltidy/htmltidy.module
===================================================================
--- modules/htmltidy/htmltidy.module	(revision 1823)
+++ modules/htmltidy/htmltidy.module	(working copy)
@@ -197,7 +197,7 @@
 
     // Run Tidy a second time to get line numbers right.
     if (variable_get('htmltidy_runtwice', 0)) {
-      system("$apppath $cline -wrap $wordwrap -utf8 -f $warningsFilename $dirtyFilename");
+      system(escapeshellarg($apppath) ." $cline -wrap $wordwrap -utf8 -f $warningsFilename $dirtyFilename");
     }
     $warnings = file_get_contents($warningsFilename);
     drupal_set_message("<h3>HTMLTidy Debug</h3><kbd>$apppath $cline -wrap $wordwrap -utf8 -f $warningsFilename $dirtyFilename</kbd>");
@@ -532,13 +532,13 @@
   }
 
   // now test it
-  $command = escapeshellcmd($tidypath .' -v');
+  $command = escapeshellarg($tidypath) .' -v';
   if (exec($command, $response)) {
     $version = $response[0];
     return TRUE;
   }
   else {
-    $message = "Found a 'tidy' binary, but it didn't run right. \n$command\nfailed to respond correctly";
+    $message = "Found a 'tidy' binary, but it didn't run right. $command failed to respond correctly";
     return FALSE;
   }
 }
@@ -563,7 +563,7 @@
   $args[] = '-f ' . $warningsFilename;
 
   // Run Tidy with the right options.
-  $command = $tidypath .' '. implode(' ', $args) .' '. $dirtyFilename;
+  $command = escapeshellarg($tidypath) .' '. implode(' ', $args) .' '. $dirtyFilename;
   system($command, $return_value);
 
   // return_value 0 means success. 1 means warning. 2 means error, the file