--- a/mercurial/windows.py	Mon Jul 31 14:55:11 2017 -0700
+++ b/mercurial/windows.py	Fri Aug 04 23:54:12 2017 -0700
@@ -204,7 +204,10 @@
         raise error.Abort(
             _('illegal ssh hostname or username starting with - or /: %s') %
             args)
-    return port and ("%s %s %s" % (args, pflag, port)) or args
+    args = shellquote(args)
+    if port:
+        args = '%s %s %s' % (pflag, shellquote(port), args)
+    return args
 
 def setflags(f, l, x):
     pass