diff --git a/lib/command-exists.js b/lib/command-exists.js
index 32bc1ef..2230e18 100644
--- a/lib/command-exists.js
+++ b/lib/command-exists.js
@@ -3,6 +3,7 @@
 var exec = require('child_process').exec;
 var execSync = require('child_process').execSync;
 var fs = require('fs');
+var path = require('path');
 var access = fs.access;
 var accessSync = fs.accessSync;
 var constants = fs.constants || fs;
@@ -61,6 +62,10 @@ var commandExistsUnix = function(commandName, cleanedCommandName, callback) {
 }
 
 var commandExistsWindows = function(commandName, cleanedCommandName, callback) {
+  if (/[\x00-\x1f<>:"\|\?\*]/.test(commandName)) {
+    callback(null, false);
+    return;
+  }
   var child = exec('where ' + cleanedCommandName,
     function (error) {
       if (error !== null){
@@ -88,6 +93,9 @@ var commandExistsUnixSync = function(commandName, cleanedCommandName) {
 }
 
 var commandExistsWindowsSync = function(commandName, cleanedCommandName, callback) {
+  if (/[\x00-\x1f<>:"\|\?\*]/.test(commandName)) {
+    return false;
+  }
   try {
       var stdout = execSync('where ' + cleanedCommandName, {stdio: []});
       return !!stdout;
@@ -105,6 +113,18 @@ var cleanInput = function(s) {
   return s;
 }
 
+if (isUsingWindows) {
+  cleanInput = function(s) {
+    var isPathName = /[\\]/.test(s);
+    if (isPathName) {
+      var dirname = '"' + path.dirname(s) + '"';
+      var basename = '"' + path.basename(s) + '"';
+      return dirname + ':' + basename;
+    }
+    return '"' + s + '"';
+  }
+}
+
 module.exports = function commandExists(commandName, callback) {
   var cleanedCommandName = cleanInput(commandName);
   if (!callback && typeof Promise !== 'undefined') {
diff --git a/test/executable-script.cmd b/test/executable-script.cmd
new file mode 100644
index 0000000..e69de29
diff --git a/test/test.js b/test/test.js
index a82c4d8..89ee1ba 100644
--- a/test/test.js
+++ b/test/test.js
@@ -110,5 +110,21 @@ describe('commandExists', function(){
                     });
             });
         }
+
+        if (isUsingWindows) {
+            it('it should report true if there is an executable file with that name', function(done) {
+                var commandToUse = 'test\\executable-script.cmd'
+                commandExists(commandToUse)
+                    .then(function(command){
+                        expect(command).to.be(commandToUse);
+                        done();
+                    });
+            });
+
+            it('it should report false if there is a double quotation mark in the file path', function() {
+                var commandToUse = 'test\\"executable-script.cmd'
+                expect(commandExists.sync(commandToUse)).to.be(false);
+            });
+        }
     });
 });