(Incidentally, Geany is written using Gtk and GLib, and GLib
already has a function g_shell_quote() which escapes arbitrary
filenames for /bin/sh.)
If shell syntax is not specifically needed, it would be even better
to use a mechanism not involving parsing shell syntax, like
posix_spawn(), GLib's g_spawn_async() or Python's os.spawn* family,
to launch the compiler (analogous to using prepared statements to
avoid ever having to think about SQL escaping or SQL injection).