diff --git a/flacsync/encoder.py b/flacsync/encoder.py
index d1cb542..4d068c6 100644
--- a/flacsync/encoder.py
+++ b/flacsync/encoder.py
@@ -266,8 +266,7 @@ def encode( self, force=False ):
       if force or util.newer( self.src, self.dst):
          self._pre_encode()
          # encode to OGG
-         err = sp.call( 'oggenc -q %s -o "%s" "%s"' %
-               (self.q, self.dst, self.src), shell=True, stderr=NULL)
+         err = sp.call(['oggenc', '-q', self.q, '-o', self.dst, self.src], stderr=NULL)
          if err == -2:  # keyboard interrupt
             os.remove(self.dst) # clean-up partial file
             raise KeyboardInterrupt
@@ -331,8 +330,7 @@ def set_cover( self, force=False, resize=False ):
                len(bin_cover),
                bin_cover)
          meta_block = base64.b64encode(meta_block)
-         err = sp.call( 'vorbiscomment -a -t "META_BLOCK_PICTURE=%s" "%s"' %
-                 (meta_block, self.dst), shell=True, stderr=NULL)
+         err = sp.call(['vorbiscomment', '-a', '-t', "META_BLOCK_PICTURE=%s" % meta_block, self.dst], stderr=NULL)
          return self._check_err( err, "OGG add-cover failed:" )