diff --git a/type/__dma/files/update_dma_conf.awk b/type/__dma/files/update_dma_conf.awk
index 67661fd..2f60a3d 100644
--- a/type/__dma/files/update_dma_conf.awk
+++ b/type/__dma/files/update_dma_conf.awk
@@ -18,7 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 
 function comment_line(line) {
-	# returns the position in line at which the comment'\''s text starts
+	# returns the position in line at which the comment's text starts
 	# (0 if the line is not a comment)
 	match(line, /^[ \t]*\#+[ \t]*/)
 	return RSTART ? (RLENGTH + 1) : 0
diff --git a/type/__dma/gencode-remote b/type/__dma/gencode-remote
index 1987106..a33388d 100755
--- a/type/__dma/gencode-remote
+++ b/type/__dma/gencode-remote
@@ -18,7 +18,8 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
+quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
+drop_awk_comments() { quote "$(sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@")"; }
 
 CONF_PATH=/etc/dma  # set in Makefile
 
@@ -139,13 +140,13 @@ then
 	#    options are grouped by word (the first word in the line) and appended
 	#    at the end of the file.
 
-	cat <<CODE
-awk '$(drop_awk_comments "${__type:?}/files/update_dma_conf.awk")' '${dma_conf}' '${dma_conf}' <<'EOF' >'${dma_conf}.tmp' \
-&& cat '${dma_conf}.tmp' >'${dma_conf}'
-${conf_should}
-EOF
-rm '${dma_conf}.tmp'
-CODE
+	cat <<-CODE
+	awk $(drop_awk_comments "${__type:?}/files/update_dma_conf.awk") $(quote "${dma_conf}") $(quote "${dma_conf}") <<'EOF' >$(quote "${dma_conf}.tmp") \
+	&& cat $(quote "${dma_conf}.tmp") >$(quote "${dma_conf}")
+	${conf_should}
+	EOF
+	rm $(quote "${dma_conf}.tmp")
+	CODE
 
 	config_updated=true
 	echo 'config updated' >>"${__messages_out:?}"
diff --git a/type/__dma_auth/gencode-remote b/type/__dma_auth/gencode-remote
index aee4d7f..4279b7a 100755
--- a/type/__dma_auth/gencode-remote
+++ b/type/__dma_auth/gencode-remote
@@ -18,7 +18,8 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
+quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
+drop_awk_comments() { quote "$(sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@")"; }
 
 state_is=$(cat "${__object:?}/explorer/state")
 state_should=$(cat "${__object:?}/parameter/state")
@@ -63,9 +64,9 @@ esac
 
 
 cat <<EOF
-test -f "${auth_conf}" || touch "${auth_conf}"
+test -f $(quote "${auth_conf}") || touch $(quote "${auth_conf}")
 
-awk '$(drop_awk_comments "${__type:?}/files/update_dma_auth.awk")' <'${auth_conf}' >'${auth_conf}.tmp' \
-&& cat '${auth_conf}.tmp' >'${auth_conf}'
-rm -f '${auth_conf}.tmp'
+awk $(drop_awk_comments "${__type:?}/files/update_dma_auth.awk") <$(quote "${auth_conf}") >$(quote "${auth_conf}.tmp") \
+&& cat $(quote "${auth_conf}.tmp") >$(quote "${auth_conf}")
+rm -f $(quote "${auth_conf}.tmp")
 EOF
diff --git a/type/__mail_alias/gencode-remote b/type/__mail_alias/gencode-remote
index 3eea452..4a8f889 100755
--- a/type/__mail_alias/gencode-remote
+++ b/type/__mail_alias/gencode-remote
@@ -18,7 +18,8 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
+quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
+drop_awk_comments() { quote "$(sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@")"; }
 
 aliases_file=$(cat "${__object:?}/explorer/aliases_file")
 
@@ -30,7 +31,7 @@ test -n "${aliases_file}" || {
 
 state_should=$(cat "${__object:?}/parameter/state")
 
-case $state_should
+case ${state_should}
 in
 	(present)
 		if cmp -s "${__object:?}/explorer/aliases" "${__object:?}/parameter/alias"
@@ -65,22 +66,22 @@ in
 esac
 
 cat <<EOF
-test -f '${aliases_file}' || touch '${aliases_file}'
+test -f $(quote "${aliases_file}") || touch $(quote "${aliases_file}")
 
-awk '$(drop_awk_comments "${__type:?}/files/update_aliases.awk")' <'${aliases_file}' >'${aliases_file}.tmp' \
+awk $(drop_awk_comments "${__type:?}/files/update_aliases.awk") <$(quote "${aliases_file}") >$(quote "${aliases_file}.tmp") \
 || {
-	rm -f '${aliases_file}.tmp'
+	rm -f $(quote "${aliases_file}.tmp")
 	echo 'Generating new aliases file failed!' >&2
 	exit 1
 }
 
-if ! cmp -s '${aliases_file}' '${aliases_file}.tmp'
+if ! cmp -s $(quote "${aliases_file}") $(quote "${aliases_file}.tmp")
 then
 	# aliases file was modified, replace:
-	cat '${aliases_file}.tmp' >'${aliases_file}'
+	cat $(quote "${aliases_file}.tmp") >$(quote "${aliases_file}")
 
 	# then, run newaliases if present ("missing" on Alpine Linux because of typo)
 	command -v newaliases >/dev/null 2>&1 && newaliases || true
 fi
-rm -f '${aliases_file}.tmp'
+rm -f $(quote "${aliases_file}.tmp")
 EOF