diff --git a/ec2instanceconnectcli/EC2InstanceConnectCommand.py b/ec2instanceconnectcli/EC2InstanceConnectCommand.py
index 32de406..b48a78b 100644
--- a/ec2instanceconnectcli/EC2InstanceConnectCommand.py
+++ b/ec2instanceconnectcli/EC2InstanceConnectCommand.py
@@ -10,6 +10,7 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
+import shlex
 
 class EC2InstanceConnectCommand(object):
     """
@@ -54,7 +55,7 @@ def get_command(self):
 
         #program specific command
         if len(self.program_command) > 0:
-            command = "{0} {1}".format(command, self.program_command)
+            command = "{0} {1}".format(command, shlex.quote(self.program_command))
 
         if len(self.instance_bundles) > 1:
             command = "{0} {1}".format(command, self._get_target(self.instance_bundles[1]))
diff --git a/tests/test_EC2ConnectCLI.py b/tests/test_EC2ConnectCLI.py
index 584a4e9..2e78fcf 100644
--- a/tests/test_EC2ConnectCLI.py
+++ b/tests/test_EC2ConnectCLI.py
@@ -45,7 +45,7 @@ def test_mssh_no_target(self,
         cli = EC2InstanceConnectCLI(instance_bundles, "", cli_command, logger.get_logger())
         cli.invoke_command()
         
-        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} {4}'.format(mock_file, flag, self.default_user,
+        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} \'{4}\''.format(mock_file, flag, self.default_user,
                                                                self.public_ip, command)
 
         # Check that we successfully get to the run
@@ -76,7 +76,7 @@ def test_mssh_no_target_no_public_ip(self,
         cli = EC2InstanceConnectCLI(instance_bundles, "", cli_command, logger.get_logger())
         cli.invoke_command()
 
-        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} {4}'.format(mock_file, flag, self.default_user,
+        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} \'{4}\''.format(mock_file, flag, self.default_user,
                                                                self.private_ip, command)
 
         # Check that we successfully get to the run
@@ -107,7 +107,7 @@ def test_mssh_with_target(self,
         cli = EC2InstanceConnectCLI(instance_bundles, "", cli_command, logger.get_logger())
         cli.invoke_command()
 
-        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} {4}'.format(mock_file, flag, self.default_user,
+        expected_command = 'ssh -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3} \'{4}\''.format(mock_file, flag, self.default_user,
                                                                host, command)
         # Check that we successfully get to the run
         # Since both target and availability_zone are provided, mock_instance_data should not be called
@@ -133,7 +133,7 @@ def test_msftp(self,
         mock_instance_data.return_value = self.instance_info
         mock_push_key.return_value = None
 
-        expected_command = 'sftp -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3}:{4} {5}'.format(mock_file, flag, self.default_user,
+        expected_command = 'sftp -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3}:{4} \'{5}\''.format(mock_file, flag, self.default_user,
                                                                self.public_ip, 'file1', command)
 
         cli_command = EC2InstanceConnectCommand("sftp", instance_bundles, mock_file, flag, command, logger.get_logger())
@@ -166,7 +166,7 @@ def test_mscp(self,
         mock_instance_data.return_value = self.instance_info
         mock_push_key.return_value = None
 
-        expected_command = 'scp -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3}:{4} {5} {6}@{7}:{8}'.format(mock_file, flag, self.default_user,
+        expected_command = 'scp -o "IdentitiesOnly=yes" -i {0} {1} {2}@{3}:{4} \'{5}\' {6}@{7}:{8}'.format(mock_file, flag, self.default_user,
                                                                                 self.public_ip, 'file1', command,
                                                                                 self.default_user,
                                                                                 self.public_ip, 'file4')