Calling shell command from ruby with proper argument escaping

Question

I want to do the following securely

system "echo '#{params[:message]}' > /dev/log"

What is the proper way for escaping arguments when calling a native command?

(Example evil input: '; rm -Rf *; echo 'I won.)

Answer 1

If you do

system "echo", params[:message]

Then the second argument, will be sent as an argument, it will not be executed.