diff --git a/build.py b/build.py
index fd73c6aab580dd4d345e0be160db037696d65f77..7dcf3cb250f1ac2c73ad58ee5979ee49b41786e4 100644
--- a/build.py
+++ b/build.py
@@ -8,6 +8,7 @@ make image
 """
 import os
 import sys
+import shlex
 from log import log_init
 from utils import rm, trace_execute
 
@@ -66,29 +67,29 @@ class Build(object):
         obs_epo_prj:
         obs_extras_prj:
         """
-        cmd = "sed -i 's/checkdep=.*/checkdep=%s/g' script/setup_env.sh" % check_dep
+        cmd = "sed -i 's/checkdep=.*/checkdep=%s/g' script/setup_env.sh" % shlex.quote(check_dep)
         rmsg = os.popen(cmd).read()
         print(rmsg)
         if obs_repo_ip:
-            cmd = "sed -i 's/OBS_SERVER_IP=.*/OBS_SERVER_IP=%s/g' script/setup_env.sh" % obs_repo_ip
+            cmd = "sed -i 's/OBS_SERVER_IP=.*/OBS_SERVER_IP=%s/g' script/setup_env.sh" % shlex.quote(obs_repo_ip)
             rmsg = os.popen(cmd).read()
             print(rmsg)
-        cmd = "sed -i 's/OBS_STANDARD_PROJECT=.*/OBS_STANDARD_PROJECT=%s/g' script/setup_env.sh" % obs_standard_prj
+        cmd = "sed -i 's/OBS_STANDARD_PROJECT=.*/OBS_STANDARD_PROJECT=%s/g' script/setup_env.sh" % shlex.quote(obs_standard_prj)
         rmsg = os.popen(cmd).read()
         print(rmsg)
-        cmd = "sed -i 's/OBS_EPOL_PROJECT=.*/OBS_EPOL_PROJECT=%s/g' script/setup_env.sh" % obs_epol_prj
+        cmd = "sed -i 's/OBS_EPOL_PROJECT=.*/OBS_EPOL_PROJECT=%s/g' script/setup_env.sh" % shlex.quote(obs_epol_prj)
         rmsg = os.popen(cmd).read()
         print(rmsg)
-        cmd = "sed -i 's/OBS_EXTRAS_PROJECT=.*/OBS_EXTRAS_PROJECT=%s/g' script/setup_env.sh" % obs_extras_prj
+        cmd = "sed -i 's/OBS_EXTRAS_PROJECT=.*/OBS_EXTRAS_PROJECT=%s/g' script/setup_env.sh" % shlex.quote(obs_extras_prj)
         rmsg = os.popen(cmd).read()
         print(rmsg)
         cmd = "cat script/setup_env.sh | grep OBS_EPOL_MULTI_VERSION_LIST"
         rmsg = os.popen(cmd).read().split("=")[1].replace("\n", "")
         if not rmsg:
-            cmd = "osc list | grep ^%s:Multi" % obs_epol_prj
+            cmd = "osc list | grep ^%s:Multi" % shlex.quote(obs_epol_prj)
             rmsg = os.popen(cmd).read().replace("\n", " ").strip()
             cmd = "sed -i 's/OBS_EPOL_MULTI_VERSION_LIST=.*/OBS_EPOL_MULTI_VERSION_LIST=\"{0}\"/g' \
-                    script/setup_env.sh".format(rmsg)
+                    script/setup_env.sh".format(shlex.quote(rmsg))
             rmsg = os.popen(cmd).read()
             print(rmsg)
 
@@ -115,7 +116,7 @@ class Build(object):
             return -1
 
         if step:
-            cmd = 'echo "export STEP=%s" >> script/setup_env.sh' % step
+            cmd = 'echo "export STEP=%s" >> script/setup_env.sh' % shlex.quote(step)
             if os.system(cmd) != 0:
                 logger.error("build fail")
                 return -1