A proper fix is not to shell out to a command at all; use getpwnam(3) or similar.