diff --git a/index.js b/index.js
index b408649..01fad4f 100644
--- a/index.js
+++ b/index.js
@@ -1,11 +1,12 @@
 const path = require('path')
-const { execSync } = require('child_process')
+const { execFileSync } = require('child_process')
 const settings = {}
 settings.disableRegisterGlobalModel = false
 
 function run (script) {
+  const scriptPath = path.join(__dirname, script)
   try {
-    const stdout = execSync(`php ${path.join(__dirname, script)}`)
+    const stdout = execFileSync('php', [scriptPath])
     return stdout.toString()
   } catch (err) {
     throw new Error(`PHP process exited with code ${err.status}`)
@@ -27,7 +28,7 @@ function runWithData (template, model) {
   const jsonModel = JSON.stringify(model, circular())
 
   try {
-    const stdout = execSync(`php ${path.join(__dirname, '/loader.php')}`, {
+    const stdout = execFileSync('php', [path.join(__dirname, '/loader.php')], {
       input: jsonModel
     })
     return stdout.toString()
diff --git a/test/test.js b/test/test.js
index dd25008..d5daf6b 100644
--- a/test/test.js
+++ b/test/test.js
@@ -34,6 +34,14 @@ test.serial('Executing a PHP script that has a coding error with `run`', async t
   }
 })
 
+test.serial('Shell metacharacters in the script path are not executed as shell commands', async t => {
+  try {
+    await php.run('./test/lib/templates/selfContainedTest.php; echo pwned')
+  } catch (e) {
+    t.true(e.message.includes('PHP process exited with code'))
+  }
+})
+
 test.serial('Executing a PHP script that has a coding error with `runWithData`', async t => {
   try {
     await php.runWithData('./test/lib/templates/codingError.php')