This is just terrible programming. Everything should get escaped and quoted before interacting with any code.