diff --git a/utility/restore.php b/utility/restore.php
index 3bb9bc52b353db4e455a7513d2745c4a69e978fa..246dd2a3e843f1f5f985005bef6b52f8dea1db81 100644
--- a/utility/restore.php
+++ b/utility/restore.php
@@ -142,9 +142,10 @@ if($operation == 'import') {
 			list($dbhost, $dbport) = explode(':', $dbhost);
 			$query = $db->query("SHOW VARIABLES LIKE 'basedir'");
 			list(, $mysql_base) = $db->fetch_array($query, $db->drivertype == 'mysqli' ? MYSQLI_NUM : MYSQL_NUM);
-			$datafile = addslashes(dirname(dirname(__FILE__))).str_replace('..', '', $datafile) ;
+			$datafile = addslashes(dirname(dirname(__FILE__))).str_replace('..', '', $datafile);
+			$datafile = escapeshellarg($datafile);
 			$mysqlbin = $mysql_base == '/' ? '' : addslashes(rtrim($mysql_base, '/\\')).'/bin/';
-			@shell_exec($mysqlbin.'mysql -h"'.$dbhost.'"'.($dbport ? (is_numeric($dbport) ? ' -P'.$dbport : ' -S"'.$dbport.'"') : '').' -u"'.$dbuser.'" -p"'.$dbpw.'" "'.$dbname.'" < '.$datafile);
+			@shell_exec($mysqlbin.'mysql --host="'.$dbhost.'"'.($dbport ? (is_numeric($dbport) ? ' --port='.$dbport : ' --socket="'.$dbport.'"') : '').' --user="'.$dbuser.'" --password="'.$dbpw.'" "'.$dbname.'" < '.$datafile);
 			if($delunzip) {
 				@unlink($datafile);
 			}