diff -r 5a7733563c2e -r d8fa35c28335 mercurial/sshrepo.py
--- a/mercurial/sshrepo.py	Sat Nov 26 00:10:12 2011 +0100
+++ b/mercurial/sshrepo.py	Sat Nov 26 00:10:31 2011 +0100
@@ -18,6 +18,10 @@
         if self.repo:
             self.release()
 
+def _serverquote(s):
+    '''quote a string for the remote shell ... which we assume is sh'''
+    return "'%s'" % s.replace("'", "'\\''")
+
 class sshrepository(wireproto.wirerepository):
     def __init__(self, ui, path, create=False):
         self._url = path
@@ -40,9 +44,9 @@
         args = util.sshargs(sshcmd, self.host, self.user, self.port)
 
         if create:
-            cmd = '%s %s "%s init %s"'
-            cmd = cmd % (sshcmd, args, remotecmd, self.path)
-
+            cmd = '%s %s %s' % (sshcmd, args,
+                util.shellquote("%s init %s" %
+                    (_serverquote(remotecmd), _serverquote(self.path))))
             ui.note(_('running %s\n') % cmd)
             res = util.system(cmd)
             if res != 0:
@@ -57,11 +61,11 @@
         # cleanup up previous run
         self.cleanup()
 
-        cmd = '%s %s "%s -R %s serve --stdio"'
-        cmd = cmd % (sshcmd, args, remotecmd, self.path)
-
+        cmd = '%s %s %s' % (sshcmd, args,
+            util.shellquote("%s -R %s serve --stdio" %
+                (_serverquote(remotecmd), _serverquote(self.path))))
+        ui.note(_('running %s\n') % cmd)
         cmd = util.quotecommand(cmd)
-        ui.note(_('running %s\n') % cmd)
         self.pipeo, self.pipei, self.pipee = util.popen3(cmd)
 
         # skip any noise generated by remote shell