diff --git a/get_sources.sh b/get_sources.sh
index 247c43e..36d7114 100755
--- a/get_sources.sh
+++ b/get_sources.sh
@@ -117,7 +117,7 @@ fi
 # should go into a function section at some point
 weakHashDetection () {
   strHash=${1};
-  case $((`echo ${strHash}|wc -m` - 1 )) in
+  case $((`echo "${strHash}"|wc -m` - 1 )) in
     128)
       hashBin='sha512sum'
       ;;
@@ -186,10 +186,10 @@ fi
 while read -r fsha fname ; do
   if [ ".${fsha}" = ".da39a3ee5e6b4b0d3255bfef95601890afd80709" ]; then
     # zero byte file
-    touch ${fname}
+    touch "${fname}"
   else
     if [ ${CHECK} -eq 1 ]; then
-      hashType=$(weakHashDetection ${fsha})
+      hashType=$(weakHashDetection "${fsha}")
       if [ "${hashType}" == "unknown" ]; then
         echo 'Failure: Hash type unknown.' >&2
         exit 1;
@@ -203,15 +203,15 @@ while read -r fsha fname ; do
     fi
     if [ -e ${fname} -a ${CHECK} -eq 1 ]; then
 	# check hash sum and force download if wrong
-        downsum=$(${hashType} ${fname} | awk '{print $1}')
+        downsum=$(${hashType} "${fname}" | awk '{print $1}')
         if [ "${fsha}" != "${downsum}" ]; then
-            rm -f ${fname}
+            rm -f "${fname}"
         fi
     fi
     if [ ! -e "${fname}" ]; then
       for br in "${branches[@]}"
       do
-        br=$(echo ${br}| sed -e s'|remotes/origin/||')
+        br=$(echo "${br}"| sed -e s'|remotes/origin/||')
         url="${SURL}/${pn}/${br}/${fsha}"
         echo "Retrieving ${url}"
         curl -L ${QUIET} -f "${url}" -o "${fname}" && break
@@ -220,9 +220,9 @@ while read -r fsha fname ; do
       echo "${fname} exists. skipping"
     fi
     if [ ${CHECK} -eq 1 ]; then
-        downsum=$(${hashType} ${fname} | awk '{print $1}')
+        downsum=$(${hashType} "${fname}" | awk '{print $1}')
         if [ "${fsha}" != "${downsum}" ]; then
-            rm -f ${fname}
+            rm -f "${fname}"
             echo "Failure: ${fname} hash does not match hash from the .metadata file" >&2
             exit 1;
         fi