diff --git a/ExploitProtection.PY b/ExploitProtection.PY
index 4354ab5..6444927 100644
--- a/ExploitProtection.PY
+++ b/ExploitProtection.PY
@@ -53,6 +53,17 @@ def run_powershell(command):
         print(f"PS Error: {e}")
         return None
 
+def ps_quote(value):
+    """Escape a path for safe use inside a single-quoted PowerShell string.
+
+    In PowerShell a literal single quote inside a single-quoted string is
+    escaped by doubling it (''). Paths containing an apostrophe otherwise
+    break the command or enable command injection via a crafted '; <cmd>; '
+    sequence.
+    """
+    return value.replace("'", "''")
+
+
 def update_online_xml():
     # Changed from ProgramFiles to Downloads to avoid strict permission issues
     dl_folder = os.path.join(os.path.expanduser("~"), "Downloads")
@@ -69,7 +80,7 @@ def update_online_xml():
 
     if os.path.exists(file_path):
         # 1. Try PowerShell Validation
-        cmd = f"Set-ProcessMitigation -PolicyFilePath '{file_path}' -IsValid"
+        cmd = f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}' -IsValid"
         res = run_powershell(cmd)
         
         is_valid = False
@@ -89,7 +100,7 @@ def update_online_xml():
                 pass
 
         if is_valid:
-            run_powershell(f"Set-ProcessMitigation -PolicyFilePath '{file_path}'")
+            run_powershell(f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}'")
             messagebox.showinfo("Update completed", "Reboot to finalize protection")
         else:
             # Include debug info in error
@@ -112,7 +123,7 @@ def backup_current_settings():
     full_path = os.path.join(directory_name, f"{name}.xml")
     
     # Run Backup
-    cmd = f"Get-ProcessMitigation -RegistryConfigFilePath '{full_path}'"
+    cmd = f"Get-ProcessMitigation -RegistryConfigFilePath '{ps_quote(full_path)}'"
     run_powershell(cmd)
     
     if os.path.exists(full_path):
@@ -195,7 +206,7 @@ def remove_all_protection():
 def import_local_xml():
     file_path = filedialog.askopenfilename(title="Select XML File", filetypes=[("XML files", "*.xml")])
     if file_path:
-        cmd = f"Set-ProcessMitigation -PolicyFilePath '{file_path}'"
+        cmd = f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}'"
         run_powershell(cmd)
         messagebox.showinfo("Reboot to update.", f"Import completed from {file_path}")