diff --git a/build/common/commands/new.py b/build/common/commands/new.py
index cab9bc61..3438fa89 100644
--- a/build/common/commands/new.py
+++ b/build/common/commands/new.py
@@ -5,6 +5,7 @@ import semantic_version
 from frappe.commands.site import _new_site
 from frappe.installer import update_site_config
 from check_connection import get_config, get_site_config, COMMON_SITE_CONFIG_FILE
+from utils import run_command
 
 
 def get_password(env_var, default=None):
@@ -91,31 +92,26 @@ def main():
 
     if db_type == "mariadb":
         site_config = get_site_config(site_name)
+        db_name = site_config.get('db_name')
+        db_password = site_config.get('db_password')
 
-        mysql_command = 'mysql -h{db_host} -u{mariadb_root_username} -p{mariadb_root_password} -e '.format(
-            db_host=config.get('db_host'),
-            mariadb_root_username=mariadb_root_username,
-            mariadb_root_password=mariadb_root_password
-        )
+        mysql_command = ["mysql", f"-h{db_host}", f"-u{mariadb_root_username}", f"-p{mariadb_root_password}", "-e"]
+
+        # Drop User if exists
+        command = mysql_command + [f"DROP USER IF EXISTS '{db_name}'@'%'; FLUSH PRIVILEGES;"]
+        run_command(command)
 
         # update User's host to '%' required to connect from any container
-        command = mysql_command + "\"UPDATE mysql.user SET Host = '%' where User = '{db_name}'; FLUSH PRIVILEGES;\"".format(
-            db_name=site_config.get('db_name')
-        )
-        os.system(command)
+        command = mysql_command + [f"UPDATE mysql.user SET Host = '%' where User = '{db_name}'; FLUSH PRIVILEGES;"]
+        run_command(command)
 
         # Set db password
-        command = mysql_command + "\"ALTER USER '{db_name}'@'%' IDENTIFIED BY '{db_password}'; FLUSH PRIVILEGES;\"".format(
-            db_name=site_config.get('db_name'),
-            db_password=site_config.get('db_password')
-        )
-        os.system(command)
+        command = mysql_command + [f"ALTER USER '{db_name}'@'%' IDENTIFIED BY '{db_password}'; FLUSH PRIVILEGES;"]
+        run_command(command)
 
         # Grant permission to database
-        command = mysql_command + "\"GRANT ALL PRIVILEGES ON \`{db_name}\`.* TO '{db_name}'@'%'; FLUSH PRIVILEGES;\"".format(
-            db_name=site_config.get('db_name')
-        )
-        os.system(command)
+        command = mysql_command + [f"GRANT ALL PRIVILEGES ON `{db_name}`.* TO '{db_name}'@'%'; FLUSH PRIVILEGES;"]
+        run_command(command)
 
     if frappe.redis_server:
         frappe.redis_server.connection_pool.disconnect()
diff --git a/build/common/commands/restore_backup.py b/build/common/commands/restore_backup.py
index efb51545..7de34367 100644
--- a/build/common/commands/restore_backup.py
+++ b/build/common/commands/restore_backup.py
@@ -8,6 +8,7 @@ import boto3
 
 from new import get_password
 from push_backup import DATE_FORMAT, check_environment_variables
+from utils import run_command
 from frappe.utils import get_sites, random_string
 from frappe.installer import make_conf, get_conf_params, make_site_dirs, update_site_config
 from check_connection import get_site_config, get_config, COMMON_SITE_CONFIG_FILE
@@ -28,21 +29,17 @@ def get_backup_dir():
     )
 
 
-def decompress_db(files_base, site):
-    database_file = files_base + '-database.sql.gz'
-    command = 'gunzip -c {database_file} > {database_extract}'.format(
-        database_file=database_file,
-        database_extract=database_file.replace('.gz', '')
-    )
-
-    print('Extract Database GZip for site {}'.format(site))
-    os.system(command)
+def decompress_db(database_file, site):
+    command = ["gunzip", "-c", database_file]
+    with open(database_file.replace(".gz", ""), "w") as db_file:
+        print('Extract Database GZip for site {}'.format(site))
+        run_command(command, stdout=db_file)
 
 
 def restore_database(files_base, site_config_path, site):
     # restore database
     database_file = files_base + '-database.sql.gz'
-    decompress_db(files_base, site)
+    decompress_db(database_file, site)
     config = get_config()
 
     # Set db_type if it exists in backup site_config.json
@@ -203,28 +200,17 @@ def restore_postgres(config, site_config, database_file):
     db_name = site_config.get('db_name')
     db_password = site_config.get('db_password')
 
-    psql_command = "psql postgres://{root_login}:{root_password}@{db_host}:{db_port}".format(
-        root_login=db_root_user,
-        root_password=db_root_password,
-        db_host=db_host,
-        db_port=db_port
-    )
+    psql_command = ["psql"]
+    psql_uri = f"postgres://{db_root_user}:{db_root_password}@{db_host}:{db_port}"
 
     print('Restoring PostgreSQL')
-    os.system(psql_command + ' -c "DROP DATABASE IF EXISTS \"{db_name}\""'.format(db_name=db_name))
-    os.system(psql_command + ' -c "DROP USER IF EXISTS {db_name}"'.format(db_name=db_name))
-    os.system(psql_command + ' -c "CREATE DATABASE \"{db_name}\""'.format(db_name=db_name))
-    os.system(psql_command + ' -c "CREATE user {db_name} password \'{db_password}\'"'.format(
-        db_name=db_name,
-        db_password=db_password))
-    os.system(psql_command + ' -c "GRANT ALL PRIVILEGES ON DATABASE \"{db_name}\" TO {db_name}"'.format(
-        db_name=db_name))
-
-    os.system("{psql_command}/{db_name} < {database_file}".format(
-        psql_command=psql_command,
-        database_file=database_file.replace('.gz', ''),
-        db_name=db_name,
-    ))
+    run_command(psql_command + [psql_uri, "-c", f"DROP DATABASE IF EXISTS \"{db_name}\""])
+    run_command(psql_command + [psql_uri, "-c", f"DROP USER IF EXISTS {db_name}"])
+    run_command(psql_command + [psql_uri, "-c", f"CREATE DATABASE \"{db_name}\""])
+    run_command(psql_command + [psql_uri, "-c", f"CREATE user {db_name} password '{db_password}'"])
+    run_command(psql_command + [psql_uri, "-c", f"GRANT ALL PRIVILEGES ON DATABASE \"{db_name}\" TO {db_name}"])
+    with open(database_file.replace('.gz', ''), 'r') as db_file:
+        run_command(psql_command + [f"{psql_uri}/{db_name}", "<"], stdin=db_file)
 
 
 def restore_mariadb(config, site_config, database_file):
@@ -236,54 +222,32 @@ def restore_mariadb(config, site_config, database_file):
     db_root_user = os.environ.get("DB_ROOT_USER", 'root')
 
     db_host = site_config.get('db_host', config.get('db_host'))
-    db_port = site_config.get('db_port', config.get('db_port'))
+    db_port = site_config.get('db_port', config.get('db_port', 3306))
+    db_name = site_config.get('db_name')
+    db_password = site_config.get('db_password')
 
     # mysql command prefix
-    mysql_command = 'mysql -u{db_root_user} -h{db_host} -p{db_password}'.format(
-        db_root_user=db_root_user,
-        db_host=db_host,
-        db_port=db_port,
-        db_password=db_root_password
-    )
+    mysql_command = ["mysql", f"-u{db_root_user}", f"-h{db_host}", f"-p{db_root_password}", f"-P{db_port}"]
 
     # drop db if exists for clean restore
-    drop_database = "{mysql_command} -e \"DROP DATABASE IF EXISTS \`{db_name}\`;\"".format(
-        mysql_command=mysql_command,
-        db_name=site_config.get('db_name'),
-    )
-    os.system(drop_database)
+    drop_database = mysql_command + ["-e",  f"DROP DATABASE IF EXISTS `{db_name}`;"]
+    run_command(drop_database)
 
     # create db
-    create_database = "{mysql_command} -e \"CREATE DATABASE IF NOT EXISTS \`{db_name}\`;\"".format(
-        mysql_command=mysql_command,
-        db_name=site_config.get('db_name'),
-    )
-    os.system(create_database)
+    create_database = mysql_command + ["-e", f"CREATE DATABASE IF NOT EXISTS `{db_name}`;"]
+    run_command(create_database)
 
     # create user
-    create_user = "{mysql_command} -e \"CREATE USER IF NOT EXISTS \'{db_name}\'@\'%\' IDENTIFIED BY \'{db_password}\'; FLUSH PRIVILEGES;\"".format(
-        mysql_command=mysql_command,
-        db_name=site_config.get('db_name'),
-        db_password=site_config.get('db_password'),
-    )
-    os.system(create_user)
+    create_user = mysql_command + ["-e", f"CREATE USER IF NOT EXISTS '{db_name}'@'%' IDENTIFIED BY '{db_password}'; FLUSH PRIVILEGES;"]
+    run_command(create_user)
 
     # grant db privileges to user
-    grant_privileges = "{mysql_command} -e \"GRANT ALL PRIVILEGES ON \`{db_name}\`.* TO '{db_name}'@'%' IDENTIFIED BY '{db_password}'; FLUSH PRIVILEGES;\"".format(
-        mysql_command=mysql_command,
-        db_name=site_config.get('db_name'),
-        db_password=site_config.get('db_password'),
-    )
-    os.system(grant_privileges)
-
-    command = "{mysql_command} '{db_name}' < {database_file}".format(
-        mysql_command=mysql_command,
-        db_name=site_config.get('db_name'),
-        database_file=database_file.replace('.gz', ''),
-    )
+    grant_privileges = mysql_command + ["-e", f"GRANT ALL PRIVILEGES ON `{db_name}`.* TO '{db_name}'@'%' IDENTIFIED BY '{db_password}'; FLUSH PRIVILEGES;"]
+    run_command(grant_privileges)
 
     print('Restoring MariaDB')
-    os.system(command)
+    with open(database_file.replace('.gz', ''), 'r') as db_file:
+        run_command(mysql_command + [f"{db_name}"], stdin=db_file)
 
 
 def main():
diff --git a/build/common/commands/utils.py b/build/common/commands/utils.py
new file mode 100644
index 00000000..c808132e
--- /dev/null
+++ b/build/common/commands/utils.py
@@ -0,0 +1,15 @@
+import subprocess
+
+
+def run_command(command, stdout=None, stdin=None, stderr=None):
+    stdout = stdout or subprocess.PIPE
+    stderr = stderr or subprocess.PIPE
+    stdin = stdin or subprocess.PIPE
+    process = subprocess.Popen(command, stdout=stdout, stdin=stdin, stderr=stderr)
+    out, error = process.communicate()
+    if process.returncode:
+        print("Something went wrong:")
+        print(f"return code: {process.returncode}")
+        print(f"stdout:\n{out}")
+        print(f"\nstderr:\n{error}")
+        exit(process.returncode)