I'd encourage you to look at the system documentation and pass a list rather than try to quote things.

That having been said, I've used this at times:

sub shell_escape {
    my ( $string ) = @_;

    $string =~ s/\\/\\\\/g;
    $string =~ s/\"/\\\"/g;
    $string =~ s/\$/\\\$/g;
    $string =~ s/\`/\\\`/g;

    return $string;
}
[download]

I use this to quote a string that I'm going to pass to the shell in double quotes.

my $suspect = shift;
my $quoted_suspect = shell_escape( $suspect );
system( qq{echo "$quoted_suspect"} );
[download]

As I recall, I got the list of characters to quote from the bash man page somewhere, but I don't recall where. I'm comfortable using it to pass my arguments as I like, but I'm not sure I'd trust it to correctly escape a string created by a malicious attacker. In that case, use at your own risk.