-  Is there a standard safe way to encode the string parameters vs. just adding them to the command string?
- Is there a recommended way to encode for UNIX/Linux string parameters when using the INPUT THROUGH or other OS-COMMAND type operations?

There isn't a standard way to encode the parameters that will work in every case. In many cases user should be able to use strong quotes (single quotes) to avoid any parsing of the parameters. However, if the parameters themselves include single-quote characters user may run into problems. For example, it's legal to use the (') and (") characters in file names on Unix. If a file name is as string'stest.txt and is surrounded with single quotes it won't work because it looks like string'stest.txt' and the unbalanced quotes cause an error. 

The OS-COMMAND, INPUT THROUGH, and UNIX statements are susceptible to these issues. If the command and/or its parameters can be input by the user, the application must ensure that the input is safe. OpenEdge can't do this for the application as it doesn't know the semantics of the command being executed. In most cases, the user inputs only a file name and the command is hardcoded by the application. In these cases it is not too difficult to parse the file name to make sure that it is safe. A common recommendation is to use a whitelist of characters which the application allows in filenames. The whitelist could be as follows: 

a-z 
A-Z 
0-9 
underscore (_) 
dash (-) 
period (.) 

Filenames with other characters can be rejected before executing the OS-COMMAND, INPUT THROUGH, or UNIX statements. Also it may allow spaces in file names, in which case the name needs to be surrounded with quotes (either single or double, since the whitelist doesn't allow any quotes) before executing the ABL statement to which the file name parameter is passed.