diff --git a/blockcheck.sh b/blockcheck.sh
index f46d305..188aaf8 100755
--- a/blockcheck.sh
+++ b/blockcheck.sh
@@ -452,7 +452,7 @@ curl_with_dig()
 	# $2 - domain name
 	# $3 - port
 	# $4+ - curl params
-	local connect_to=$(curl_connect_to $1 $2 $3)
+	local connect_to="$(curl_connect_to $1 $2 $3)"
 	[ -n "$connect_to" ] || {
 		echo "could not resolve ipv$1 $2"
 		return 6
@@ -749,7 +749,7 @@ xxxws_curl_test_update()
 	shift
 	$xxxf $testf $dom "$@"
 	code=$?
-	[ $code = 0 ] && strategy="${strategy:-$@}"
+	[ $code = 0 ] && strategy="${WF:+$WF }${strategy:-$@}"
 	return $code
 }
 pktws_curl_test_update()
@@ -786,7 +786,7 @@ report_strategy()
 	if [ -n "$strategy" ]; then
 		echo "!!!!! $1: working strategy found for ipv${IPV} $2 : $3 $strategy !!!!!"
 		echo
-		report_append "ipv${IPV} $2 $1 : $3 ${WF:+$WF }$strategy"
+		report_append "ipv${IPV} $2 $1 : $3 $strategy"
 		return 0
 	else
 		echo "$1: $3 strategy for ipv${IPV} $2 not found"
diff --git a/common/base.sh b/common/base.sh
index b6c82c4..04966c1 100644
--- a/common/base.sh
+++ b/common/base.sh
@@ -60,7 +60,7 @@ find_str_in_list()
 }
 end_with_newline()
 {
-	local c=$(tail -c 1)
+	local c="$(tail -c 1)"
 	[ "$c" = "" ]
 }
 
@@ -140,7 +140,7 @@ linux_min_version()
 }
 linux_get_subsys()
 {
-	local INIT=$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)
+	local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)"
 
 	[ -L "$INIT" ] && INIT=$(readlink "$INIT")
 	INIT=$(basename "$INIT")
@@ -213,7 +213,7 @@ fsleep_setup()
 	elif busybox usleep 1 2>/dev/null; then
 		FSLEEP=2
 	else
-		local errtext=$(read -t 0.001 2>&1)
+		local errtext="$(read -t 0.001 2>&1)"
 		if [ -z "$errtext" ]; then
 			FSLEEP=3
 		# newer openwrt has ucode with system function that supports timeout in ms
diff --git a/common/installer.sh b/common/installer.sh
index 1077ac5..94a7f28 100644
--- a/common/installer.sh
+++ b/common/installer.sh
@@ -86,7 +86,7 @@ check_system()
 	UNAME=$(uname)
 	if [ "$UNAME" = "Linux" ]; then
 		# do not use 'exe' because it requires root
-		local INIT=$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)
+		local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)"
 		[ -L "$INIT" ] && INIT=$(readlink "$INIT")
 		INIT=$(basename "$INIT")
 		# some distros include systemctl without systemd
@@ -316,7 +316,7 @@ check_package_exists_openwrt()
 check_package_openwrt()
 {
 	[ -n "$(opkg list-installed $1)" ] && return 0
-	local what=$(opkg whatprovides $1 | tail -n +2 | head -n 1)
+	local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
 	[ -n "$what" ] || return 1
 	[ -n "$(opkg list-installed $what)" ]
 }
@@ -361,7 +361,7 @@ openwrt_fw_section_del()
 {
 	# $1 - fw include postfix
 
-	local id=$(openwrt_fw_section_find $1)
+	local id="$(openwrt_fw_section_find $1)"
 	[ -n "$id" ] && {
 		uci delete firewall.@include[$id] && uci commit firewall
 		rm -f "$OPENWRT_FW_INCLUDE$1"
@@ -377,7 +377,7 @@ openwrt_fw_section_add()
 }
 openwrt_fw_section_configure()
 {
-	local id=$(openwrt_fw_section_add $1)
+	local id="$(openwrt_fw_section_add $1)"
 	[ -z "$id" ] ||
 	 ! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" ||
 	 ! uci set firewall.@include[$id].reload="1" ||
diff --git a/common/linux_fw.sh b/common/linux_fw.sh
index 270a238..dbddc65 100644
--- a/common/linux_fw.sh
+++ b/common/linux_fw.sh
@@ -50,4 +50,4 @@ first_packets_for_mode()
 		n=6
 	fi
 	echo $n
-}
\ No newline at end of file
+}
diff --git a/common/virt.sh b/common/virt.sh
index bc84450..6e566d6 100644
--- a/common/virt.sh
+++ b/common/virt.sh
@@ -24,7 +24,7 @@ get_virt()
 check_virt()
 {
 	echo \* checking virtualization
-	local vm=$(get_virt)
+	local vm="$(get_virt)"
 	if [ -n "$vm" ]; then
 		if [ "$vm" = "none" ]; then
 			echo running on bare metal
diff --git a/init.d/macos/functions b/init.d/macos/functions
index fc78b13..fbafd1a 100644
--- a/init.d/macos/functions
+++ b/init.d/macos/functions
@@ -25,7 +25,7 @@ run_daemon()
 	# $2 - daemon
 	# $3 - daemon args
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
-	local DAEMONBASE="$(basename $2)"
+	local DAEMONBASE="$(basename "$2")"
 	local PIDFILE="$PIDDIR/$DAEMONBASE$1.pid"
 	local ARGS="--daemon --pidfile=$PIDFILE $3"
 	[ -f "$PIDFILE" ] && pgrep -qF "$PIDFILE" && {
@@ -42,7 +42,7 @@ stop_daemon()
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 
 	local PID
-	local DAEMONBASE="$(basename $2)"
+	local DAEMONBASE="$(basename "$2")"
 	local PIDFILE="$PIDDIR/$DAEMONBASE$1.pid"
 	[ -f "$PIDFILE" ] && read PID <"$PIDFILE"
 	[ -n "$PID" ] && {
diff --git a/init.d/openwrt/zapret b/init.d/openwrt/zapret
index 62e086c..cc23018 100755
--- a/init.d/openwrt/zapret
+++ b/init.d/openwrt/zapret
@@ -56,7 +56,7 @@ run_daemon()
 	# $2 - daemon
 	# $3 - daemon args
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
-	local DAEMONBASE=$(basename $2)
+	local DAEMONBASE="$(basename "$2")"
 	echo "Starting daemon $1: $2 $3"
 	procd_open_instance
 	procd_set_param command $2 $3
diff --git a/init.d/sysv/functions b/init.d/sysv/functions
index aadbb0b..d3586aa 100644
--- a/init.d/sysv/functions
+++ b/init.d/sysv/functions
@@ -166,7 +166,7 @@ run_daemon()
 	# $3 - daemon args
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 
-	local DAEMONBASE=$(basename $2)
+	local DAEMONBASE="$(basename "$2")"
 	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Starting daemon $1: $2 $3"
 	if exists start-stop-daemon ; then
@@ -191,7 +191,7 @@ stop_daemon()
 	# $1 - daemon number : 1,2,3,...
 	# $2 - daemon
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
-	local DAEMONBASE=$(basename $2)
+	local DAEMONBASE="$(basename "$2")"
 	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Stopping daemon $1: $2"
 	if exists start-stop-daemon ; then
diff --git a/install_easy.sh b/install_easy.sh
index 469acef..f7f9995 100755
--- a/install_easy.sh
+++ b/install_easy.sh
@@ -52,7 +52,7 @@ check_bins()
 	echo \* checking executables
 
 	fix_perms_bin_test "$EXEDIR"
-	local arch=$(get_bin_arch)
+	local arch="$(get_bin_arch)"
 	local make_target
 	[ "$FORCE_BUILD" = "1" ] && {
 		echo forced build mode
@@ -385,7 +385,7 @@ copy_all()
 }
 copy_openwrt()
 {
-	local ARCH=$(get_bin_arch)
+	local ARCH="$(get_bin_arch)"
 	local BINDIR="$1/binaries/$ARCH"
 	
 	[ -d "$2" ] || mkdir -p "$2"
@@ -500,7 +500,7 @@ check_location()
 					exitp 3
 				fi
 			fi
-			local B=$(dirname "$ZAPRET_TARGET")
+			local B="$(dirname "$ZAPRET_TARGET")"
 			[ -d "$B" ] || mkdir -p "$B"
 			$1 "$EXEDIR" "$ZAPRET_TARGET"
 			fix_perms "$ZAPRET_TARGET"