diff --git a/app/controller/perso.php b/app/controller/perso.php
index 92a7e29ce11f8e972735a1a90bd8acb5e4179b55..97e90a5b639779b20c7fb27c9ef8f50cfa1f52a5 100644
--- a/app/controller/perso.php
+++ b/app/controller/perso.php
@@ -390,7 +390,7 @@ class Perso extends Controller
         $db = $f3->get('DB');
         $id = $params['id'];
         $command = "pdftk ";
-        $args = " ../www/receipt.pdf fill_form ../tmp/".$id.".xfdf output ../tmp/".$id.".pdf flatten dont_ask";
+        $args = " ../www/receipt.pdf fill_form ../tmp/".escapeshellarg($id).".xfdf output ../tmp/".escapeshellarg($id).".pdf flatten dont_ask";
         $logger->write($command . " " .$args);
 
         // Vérification que le don appartient bien à l'utilisateur connecté