--- a/mercurial/commands.py	Fri Apr 29 14:14:00 2016 -0500
+++ b/mercurial/commands.py	Wed Apr 27 19:24:31 2016 -0700
@@ -4231,9 +4231,9 @@
                 repo.vfs.write('graftstate', ''.join(nodelines))
                 extra = ''
                 if opts.get('user'):
-                    extra += ' --user %s' % opts['user']
+                    extra += ' --user %s' % util.shellquote(opts['user'])
                 if opts.get('date'):
-                    extra += ' --date %s' % opts['date']
+                    extra += ' --date %s' % util.shellquote(opts['date'])
                 if opts.get('log'):
                     extra += ' --log'
                 hint=_("use 'hg resolve' and 'hg graft --continue%s'") % extra