Escape string against shell command inject

Command.php

@@ -223,15 +223,11 @@ public function getCommand(): string
     /**
      * Escapes a string in order to inject it in the shell command.
      */
-    public function escape(string $string, bool $addQuotes = true): string
+    public function escape(string $string): string
     {
-        $string = str_replace(
-            ['"', '`', '’', '\\\''],
-            ['\"', "'", "'", "'"],
-            trim($string)
-        );
+        $string = escapeshellarg($string);
 
-        return $addQuotes ? '"'.$string.'"' : $string;
+        return $string;
     }
 
     /**

Tests/CommandTest.php

@@ -153,7 +153,7 @@ public function testCommandString($source, $output, $geometry, $quality)
 
         $expected = ' '.$command->getExecutable('convert').
                     ' "'.$source.'"'.
-                    ' -thumbnail "'.$geometry.'"'.
+                    ' -thumbnail \''.$geometry.'\''.
                     ' -quality '.$quality.
                     ' "'.$output.'" ';
 
@@ -197,13 +197,13 @@ public function testInexistingFiles()
 
     public function testEscape()
     {
-        $string = 'PSR\'s a great `code` style standard. ';
+        $string = '25% $(touch hacked) #';
 
         $command = new Command(IMAGEMAGICK_DIR);
 
-        $escaped = $command->escape($string, true);
+        $escaped = $command->escape($string);
 
-        $this->assertEquals('"PSR\'s a great \'code\' style standard."', $escaped);
+        $this->assertEquals("'25% $(touch hacked) #'", $escaped);
     }
 
 }