escape string for command line

I have a simple ecard creation script on a website, where user can add
text to a graphic. I use ImageMagick for it:

# template_file => path to image template file
# new_file => path to generated file
# text => user input
command = '''convert %s -font OfficinaSanITC-BookOS -pointsize 12
-fill "#8C2F48" -draw "gravity north text 0,26 '%s'" %s''' % (
template_file, text, new_file)
system(command)

I was wondering, is there a general way to escape the string entered
by the user, to prevent code injection into command line?
Take a look at the "string-escape" encoding:

evil = "'; rm -rf /;"
command = "echo '%s'"
print command % evil.encode('string-escape')

echo '\'; rm -rf /;'
Will it
always be safe, even when binary data is submitted through POST?

I was wondering, is there a general way to escape the string entered
by the user, to prevent code injection into command line?

Take a look at the "string-escape" encoding:

evil = "'; rm -rf /;"
command = "echo '%s'"
print command % evil.encode('string-escape')

echo '\'; rm -rf /;'