Fix #549 - escape strings more appropriately for use with cmd /c

autoload/ale.vim

@@ -135,14 +135,26 @@ function! ale#Set(variable_name, default) abort
     return l:value
 endfunction
 
+function! s:EscapePercents(str) abort
+    return substitute(a:str, '%', '%%', 'g')
+endfunction
+
 " Escape a string suitably for each platform.
 " shellescape does not work on Windows.
 function! ale#Escape(str) abort
     if fnamemodify(&shell, ':t') ==? 'cmd.exe'
-        " FIXME: Fix shell escaping for Windows.
-        return fnameescape(a:str)
-    else
-        " An extra space is used here to disable the custom-checks.
-        return shellescape (a:str)
+        if a:str =~# '\v^[a-zA-Z0-9-_\\/:%]+$'
+            return s:EscapePercents(a:str)
+        endif
+
+        if a:str =~# ' '
+            return '"'
+            \   .  substitute(s:EscapePercents(a:str), '"', '""', 'g')
+            \   . '"'
+        endif
+
+        return s:EscapePercents(substitute(a:str, '\v([&|<>^])', '^\1', 'g'))
     endif
+
+    return shellescape (a:str)
 endfunction