diff --git a/package.json b/package.json
index c67ab37..5dcf2a6 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,10 @@
     "email": "franciscojsucreg@gmail.com",
     "url": "https://github.com/franciscosucre"
   },
-  "dependencies": {},
+  "dependencies": {
+    "@types/shell-escape": "^0.2.0",
+    "shell-escape": "^0.2.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/franciscosucre/sugo-wkhtmltopdf.git"
diff --git a/src/wkhtmltopdf.ts b/src/wkhtmltopdf.ts
index e5303ec..3d68ec5 100644
--- a/src/wkhtmltopdf.ts
+++ b/src/wkhtmltopdf.ts
@@ -1,4 +1,5 @@
 import { ChildProcess, spawn } from 'child_process';
+import * as shellescape from 'shell-escape';
 
 const quote = (val: string) => {
   // escape and quote the value if it is a string and this isn't windows
@@ -12,14 +13,14 @@ const quote = (val: string) => {
 export const wkhtmltopdf = (input: string, options: string[] = []) =>
   new Promise<Buffer>((resolve, reject) => {
     const isUrl = /^(https?|file):\/\//.test(input);
-    const childArgs = [wkhtmltopdf.command].concat(options, [isUrl ? quote(input) : '-', '-']);
+    const childArgs = [wkhtmltopdf.command].concat(options, [isUrl ? input : '-', '-']);
     let child: ChildProcess;
     if (process.platform === 'win32') {
       child = spawn(wkhtmltopdf.command, childArgs.slice(1));
     } else if (process.platform === 'darwin') {
-      child = spawn('/bin/sh', ['-c', childArgs.join(' ') + ' | cat ; exit ${PIPESTATUS[0]}']);
+      child = spawn('/bin/sh', ['-c', shellescape(childArgs) + ' | cat ; exit ${PIPESTATUS[0]}']);
     } else {
-      child = spawn(wkhtmltopdf.shell, ['-c', childArgs.join(' ') + ' | cat ; exit ${PIPESTATUS[0]}']);
+      child = spawn(wkhtmltopdf.shell, ['-c', shellescape(childArgs) + ' | cat ; exit ${PIPESTATUS[0]}']);
     }
     child.on('exit', (code: number) => {
       if (code !== 0) {