diff --git a/html/includes/output/db-update.inc.php b/html/includes/output/db-update.inc.php
index 29c03bc677..5eaf1ad24e 100644
--- a/html/includes/output/db-update.inc.php
+++ b/html/includes/output/db-update.inc.php
@@ -44,7 +44,7 @@ $cmd = $config['install_dir'] . '/build-base.php -l';
 
 foreach ($db_vars as $var => $opt) {
     if ($_SESSION[$var]) {
-        $cmd .= " -$opt {$_SESSION[$var]}";
+        $cmd .= " -$opt " . escapeshellarg($_SESSION[$var]);
     }
 }