diff --git a/src/Command/AbstractCommand.php b/src/Command/AbstractCommand.php
index cbbf9c6..6b45922 100644
--- a/src/Command/AbstractCommand.php
+++ b/src/Command/AbstractCommand.php
@@ -242,7 +242,7 @@ protected function assembleOptionString()
             } elseif (is_string($option) && $option !== '') {
                 $optionString .= " {$name} " . escapeshellarg($option);
             } elseif (is_array($option) && !empty($option)) {
-                $optionString .= " {$name} " . implode(' ', escapeshellarg($option));
+                $optionString .= " {$name} " . implode(' ', $option);
             }
         }
 
diff --git a/tests/Command/AddremoveCommandTest.php b/tests/Command/AddremoveCommandTest.php
index 0b72b50..6bbc0f3 100644
--- a/tests/Command/AddremoveCommandTest.php
+++ b/tests/Command/AddremoveCommandTest.php
@@ -30,7 +30,7 @@ public function addremoveCommand()
         $addremoveCmd->setDryRun(true);
 
         $file = '\'C:\xampp\file1\\\' \'C:\xampp\file2\\\'';
-        $expected = 'hg addremove --similarity 50 --include includePattern --exclude excludePattern --dry-run ';
+        $expected = 'hg addremove --similarity ' . escapeshellarg('50') . ' --include includePattern --exclude excludePattern --dry-run ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $file = str_replace("'", '"', $file);
diff --git a/tests/Command/BackoutCommandTest.php b/tests/Command/BackoutCommandTest.php
index 9a5f663..cc26912 100644
--- a/tests/Command/BackoutCommandTest.php
+++ b/tests/Command/BackoutCommandTest.php
@@ -33,7 +33,7 @@ public function backoutCommand()
         $backoutCmd->setUser('user');
 
         $revision = '\'revision\'';
-        $expected = 'hg backout --merge --tool tool --include includePattern --exclude excludePattern --message text --logfile logfile --date date --user user ';
+        $expected = 'hg backout --merge --tool ' . escapeshellarg('tool') . ' --include includePattern --exclude excludePattern --message ' . escapeshellarg('text') . ' --logfile ' . escapeshellarg('logfile') . ' --date ' . escapeshellarg('date') . ' --user ' . escapeshellarg('user') . ' ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $revision = str_replace("'", '"', $revision);
diff --git a/tests/Command/BookmarksCommandTest.php b/tests/Command/BookmarksCommandTest.php
index c672ad1..e04af4b 100644
--- a/tests/Command/BookmarksCommandTest.php
+++ b/tests/Command/BookmarksCommandTest.php
@@ -29,7 +29,7 @@ public function bookmarksCommand()
         $bookmarksCmd->setRename('name');
 
         $name = '\'test1\' \'test2\'';
-        $expected = 'hg bookmarks --force --rev revision --rename name ';
+        $expected = 'hg bookmarks --force --rev ' . escapeshellarg('revision') . ' --rename ' . escapeshellarg('name') . ' ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $name = str_replace("'", '"', $name);
diff --git a/tests/Command/BundleCommandTest.php b/tests/Command/BundleCommandTest.php
index e1549a2..a55fc4c 100644
--- a/tests/Command/BundleCommandTest.php
+++ b/tests/Command/BundleCommandTest.php
@@ -31,7 +31,7 @@ public function bundleCommand()
 
         $destination = '\'C:\xampp\dest\\\'';
         $file = '\'C:\xampp\file\\\'';
-        $expected = 'hg bundle --verbose --encoding UTF-8 --ssh testSSH --insecure ';
+        $expected = 'hg bundle --verbose --encoding ' . escapeshellarg('UTF-8') . ' --ssh ' . escapeshellarg('testSSH') . ' --insecure ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $destination = str_replace("'", '"', $destination);
diff --git a/tests/Command/CatCommandTest.php b/tests/Command/CatCommandTest.php
index eb73da5..8e3dfe0 100644
--- a/tests/Command/CatCommandTest.php
+++ b/tests/Command/CatCommandTest.php
@@ -31,7 +31,7 @@ public function catCommand()
         $catCmd->setDecode(true);
 
         $file = '\'C:\xampp\file1\\\' \'C:\xampp\file2\\\'';
-        $expected = 'hg cat --output output --rev revision --decode --include includePattern --exclude excludePattern ';
+        $expected = 'hg cat --output ' . escapeshellarg('output') . ' --rev ' . escapeshellarg('revision') . ' --decode --include includePattern --exclude excludePattern ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $file = str_replace("'", '"', $file);
diff --git a/tests/Command/CommitCommandTest.php b/tests/Command/CommitCommandTest.php
index 20cec42..7c265d7 100644
--- a/tests/Command/CommitCommandTest.php
+++ b/tests/Command/CommitCommandTest.php
@@ -38,7 +38,7 @@ public function commitCommand()
         $commitCmd->setSubrepos(true);
 
         $file = '\'C:\xampp\file1\\\' \'C:\xampp\file2\\\'';
-        $expected = 'hg commit --addremove --close-branch --amend --secret --edit --include includePattern --exclude excludePattern --message text --logfile logfile --date date --user user --subrepos ';
+        $expected = 'hg commit --addremove --close-branch --amend --secret --edit --include includePattern --exclude excludePattern --message ' . escapeshellarg('text') . ' --logfile ' . escapeshellarg('logfile') . ' --date ' . escapeshellarg('date') . ' --user ' . escapeshellarg('user') . ' --subrepos ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $file = str_replace("'", '"', $file);
diff --git a/tests/Command/HeadsCommandTest.php b/tests/Command/HeadsCommandTest.php
index 49bf374..eeba398 100644
--- a/tests/Command/HeadsCommandTest.php
+++ b/tests/Command/HeadsCommandTest.php
@@ -27,7 +27,7 @@ public function headsCommand()
         $headsCmd->setRev('startrev');
         $headsCmd->setTopo(true);
 
-        $expected = 'hg heads --rev startrev --topo --closed --template template';
+        $expected = 'hg heads --rev ' . escapeshellarg('startrev') . ' --topo --closed --template ' . escapeshellarg('template');
 
         $this->assertSame($expected, $headsCmd->asString());
     }
diff --git a/tests/Command/ImportCommandTest.php b/tests/Command/ImportCommandTest.php
index ad5febf..6c0f849 100644
--- a/tests/Command/ImportCommandTest.php
+++ b/tests/Command/ImportCommandTest.php
@@ -37,7 +37,7 @@ public function importCommand()
         $importCmd->setSimilarity('similarity');
 
         $patch = '\'patch1\' \'patch2\'';
-        $expected = 'hg import --strip num --edit --no-commit --bypass --exact --import-branch --message text --logfile logfile --date date --user user --similarity similarity ';
+        $expected = 'hg import --strip ' . escapeshellarg('num') . ' --edit --no-commit --bypass --exact --import-branch --message ' . escapeshellarg('text') . ' --logfile ' . escapeshellarg('logfile') . ' --date ' . escapeshellarg('date') . ' --user ' . escapeshellarg('user') . ' --similarity ' . escapeshellarg('similarity') . ' ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $patch = str_replace("'", '"', $patch);
diff --git a/tests/Command/InitCommandTest.php b/tests/Command/InitCommandTest.php
index 50e004d..fff39ee 100644
--- a/tests/Command/InitCommandTest.php
+++ b/tests/Command/InitCommandTest.php
@@ -29,7 +29,7 @@ public function initCommand()
         $initCmd->setEncoding('UTF-8');
 
         $destination = '\'C:\xampp\dest\\\'';
-        $expected = 'hg init --verbose --encoding UTF-8 --ssh testSSH --insecure ';
+        $expected = 'hg init --verbose --encoding ' . escapeshellarg('UTF-8') . ' --ssh ' . escapeshellarg('testSSH') . ' --insecure ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $destination = str_replace("'", '"', $destination);
diff --git a/tests/Command/ManifestCommandTest.php b/tests/Command/ManifestCommandTest.php
index 541e501..f968d82 100644
--- a/tests/Command/ManifestCommandTest.php
+++ b/tests/Command/ManifestCommandTest.php
@@ -25,7 +25,7 @@ public function manifestCommand()
         $manifestCmd->setRev('test');
         $manifestCmd->setAll(true);
 
-        $expected = 'hg manifest --rev test --all';
+        $expected = 'hg manifest --rev ' . escapeshellarg('test') . ' --all';
 
         $this->assertSame($expected, $manifestCmd->asString());
     }
diff --git a/tests/Command/MergeCommandTest.php b/tests/Command/MergeCommandTest.php
index 0d0e41a..9c1da50 100644
--- a/tests/Command/MergeCommandTest.php
+++ b/tests/Command/MergeCommandTest.php
@@ -26,7 +26,7 @@ public function mergeCommand()
         $mergeCmd->setTool('testtool');
         $mergeCmd->setPreview(true);
 
-        $expected = 'hg merge --rev revision --preview --tool testtool';
+        $expected = 'hg merge --rev ' . escapeshellarg('revision') . ' --preview --tool ' . escapeshellarg('testtool');
 
         $this->assertSame($expected, $mergeCmd->asString());
     }
diff --git a/tests/Command/ParentsCommandTest.php b/tests/Command/ParentsCommandTest.php
index 4828d53..fb68b20 100644
--- a/tests/Command/ParentsCommandTest.php
+++ b/tests/Command/ParentsCommandTest.php
@@ -27,7 +27,7 @@ public function parentsCommand()
         $parentsCmd->setTemplate('template');
 
         $file = '\'C:\xampp\file\\\'';
-        $expected = 'hg parents --rev revision --template template ';
+        $expected = 'hg parents --rev ' . escapeshellarg('revision') . ' --template ' . escapeshellarg('template') . ' ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $file = str_replace("'", '"', $file);
diff --git a/tests/Command/PhaseCommandTest.php b/tests/Command/PhaseCommandTest.php
index 40dbd78..13674e5 100644
--- a/tests/Command/PhaseCommandTest.php
+++ b/tests/Command/PhaseCommandTest.php
@@ -27,7 +27,7 @@ public function phaseCommand()
         $phaseCmd->setVerbose(true);
         $phaseCmd->setEncoding('UTF-8');
 
-        $expected = 'hg phase --verbose --encoding UTF-8 --public --force';
+        $expected = 'hg phase --verbose --encoding ' . escapeshellarg('UTF-8') . ' --public --force';
 
         $this->assertSame($expected, $phaseCmd->asString());
     }
diff --git a/tests/Command/PullCommandTest.php b/tests/Command/PullCommandTest.php
index 723d487..2366797 100644
--- a/tests/Command/PullCommandTest.php
+++ b/tests/Command/PullCommandTest.php
@@ -34,7 +34,7 @@ public function pullCommand()
         $pullCmd->setEncoding('UTF-8');
 
         $source = '\'C:\xampp\source\\\'';
-        $expected = 'hg pull --verbose --encoding UTF-8 --rev rev1 rev2 --bookmark bookmark --branch branch --ssh testSSH --insecure ';
+        $expected = 'hg pull --verbose --encoding ' . escapeshellarg('UTF-8') . ' --rev rev1 rev2 --bookmark bookmark --branch branch --ssh ' . escapeshellarg('testSSH') . ' --insecure ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $source = str_replace("'", '"', $source);
diff --git a/tests/Command/PushCommandTest.php b/tests/Command/PushCommandTest.php
index d20673b..25d819f 100644
--- a/tests/Command/PushCommandTest.php
+++ b/tests/Command/PushCommandTest.php
@@ -30,7 +30,7 @@ public function pushCommand()
         $pushCmd->setEncoding('UTF-8');
 
         $destination = '\'C:\xampp\dest\\\'';
-        $expected = 'hg push --verbose --encoding UTF-8 --ssh testSSH --insecure ';
+        $expected = 'hg push --verbose --encoding ' . escapeshellarg('UTF-8') . ' --ssh ' . escapeshellarg('testSSH') . ' --insecure ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $destination = str_replace("'", '"', $destination);
diff --git a/tests/Command/ResolveCommandTest.php b/tests/Command/ResolveCommandTest.php
index 975bdc5..98de847 100644
--- a/tests/Command/ResolveCommandTest.php
+++ b/tests/Command/ResolveCommandTest.php
@@ -34,7 +34,7 @@ public function resolveCommand()
         $resolveCmd->setNoStatus(true);
 
         $file = '\'C:\xampp\file1\\\' \'C:\xampp\file2\\\'';
-        $expected = 'hg resolve --all --list --mark --unmark --no-status --tool testtool --include includePattern --exclude excludePattern ';
+        $expected = 'hg resolve --all --list --mark --unmark --no-status --tool ' . escapeshellarg('testtool') . ' --include includePattern --exclude excludePattern ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $file = str_replace("'", '"', $file);
diff --git a/tests/Command/RevertCommandTest.php b/tests/Command/RevertCommandTest.php
index c06a7e4..5fff2a4 100644
--- a/tests/Command/RevertCommandTest.php
+++ b/tests/Command/RevertCommandTest.php
@@ -33,7 +33,7 @@ public function revertCommand()
         $revertCmd->setDryRun(true);
 
         $name = '\'name1\' \'name2\'';
-        $expected = 'hg revert --all --date date --rev revision --no-backup --include includePattern --exclude excludePattern --dry-run ';
+        $expected = 'hg revert --all --date ' . escapeshellarg('date') . ' --rev ' . escapeshellarg('revision') . ' --no-backup --include includePattern --exclude excludePattern --dry-run ';
 
         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             $name = str_replace("'", '"', $name);
diff --git a/tests/Command/TagCommandTest.php b/tests/Command/TagCommandTest.php
index d3236cf..986dbb3 100644
--- a/tests/Command/TagCommandTest.php
+++ b/tests/Command/TagCommandTest.php
@@ -34,7 +34,7 @@ public function tagCommand()
         $tagCmd->setUser('user');
 
         $name = 'rev rev2';
-        $expected = 'hg tag --force --local --rev test --remove --edit --message text --date date --user user ';
+        $expected = 'hg tag --force --local --rev ' . escapeshellarg('test') . ' --remove --edit --message ' . escapeshellarg('text') . ' --date ' . escapeshellarg('date') . ' --user ' . escapeshellarg('user') . ' ';
 
         $this->assertSame($name, implode(' ', $tagCmd->getName()));
         $this->assertSame($expected . $name, $tagCmd->asString());
diff --git a/tests/Command/UpdateCommandTest.php b/tests/Command/UpdateCommandTest.php
index 0571fb8..e01e0c9 100644
--- a/tests/Command/UpdateCommandTest.php
+++ b/tests/Command/UpdateCommandTest.php
@@ -27,7 +27,7 @@ public function updateCommand()
         $updateCmd->setDate('date');
         $updateCmd->setRev('rev');
 
-        $expected = 'hg update --clean --check --date date --rev rev';
+        $expected = 'hg update --clean --check --date ' . escapeshellarg('date') . ' --rev ' . escapeshellarg('rev');
 
         $this->assertSame($expected, $updateCmd->asString());
     }