diff --git a/lib/email-functions.sh b/lib/email-functions.sh
index 8bf898f..9ad84cf 100755
--- a/lib/email-functions.sh
+++ b/lib/email-functions.sh
@@ -6,6 +6,12 @@
 # Shared functions for email troubleshooting modules
 ################################################################################
 
+# Source system detection (for detect_control_panel function)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/system-detect.sh" ]; then
+    source "$SCRIPT_DIR/system-detect.sh"
+fi
+
 # Detect MTA (Mail Transfer Agent)
 detect_mta() {
     if command -v exim &>/dev/null; then
diff --git a/lib/mysql-analyzer.sh b/lib/mysql-analyzer.sh
index 20ba9ca..87733c5 100755
--- a/lib/mysql-analyzer.sh
+++ b/lib/mysql-analyzer.sh
@@ -133,9 +133,8 @@ map_database_to_user_domain() {
     # Build map for all databases
     print_info "Building database to user/domain mapping..."
 
-    local all_dbs=$(mysql -Ns -e "SHOW DATABASES" 2>/dev/null | grep -v "^information_schema$\|^mysql$\|^performance_schema$\|^sys$")
-
-    for db in $all_dbs; do
+    # Use while read to safely iterate over database names (handles spaces in names)
+    mysql -Ns -e "SHOW DATABASES" 2>/dev/null | grep -v "^information_schema$\|^mysql$\|^performance_schema$\|^sys$" | while IFS= read -r db; do
         # Extract potential username from database name
         # Format: username_dbname
         local potential_user=$(echo "$db" | cut -d_ -f1)
@@ -359,11 +358,10 @@ analyze_queries_for_problems() {
         # Extract database
         local db_name=$(extract_database_from_query "$query")
 
-        # Extract tables
-        local tables=$(extract_tables_from_query "$query")
+        # Extract tables and safely iterate (handles spaces in table names)
+        extract_tables_from_query "$query" | while IFS= read -r table; do
+            [ -z "$table" ] && continue  # Skip empty lines
 
-        # Identify plugins
-        for table in $tables; do
             local plugin=$(identify_plugin_from_table "$table")
             local owner=$(get_database_owner "$db_name")
             local domain=$(get_database_domain "$db_name")
diff --git a/modules/maintenance/cleanup-toolkit-data.sh b/modules/maintenance/cleanup-toolkit-data.sh
index 24fc48a..1f49b49 100755
--- a/modules/maintenance/cleanup-toolkit-data.sh
+++ b/modules/maintenance/cleanup-toolkit-data.sh
@@ -172,8 +172,8 @@ fi
 
 # Session/lock files
 for pattern in /var/run/server-toolkit* /var/lock/server-toolkit*; do
-    if ls $pattern 2>/dev/null | grep -q .; then
-        rm -f $pattern 2>/dev/null
+    if ls "$pattern" 2>/dev/null | grep -q .; then
+        rm -f "$pattern" 2>/dev/null
         echo -e "  ${GREEN}✓${NC} Removed: Session/lock files"
         ((cleaned_count++))
         break
@@ -189,9 +189,9 @@ remove_logs="${remove_logs:-no}"
 
 if [ "$remove_logs" = "yes" ]; then
     for pattern in /var/log/server-toolkit*.log; do
-        if ls $pattern 2>/dev/null | grep -q .; then
-            count=$(ls $pattern 2>/dev/null | wc -l)
-            rm -f $pattern 2>/dev/null
+        if ls "$pattern" 2>/dev/null | grep -q .; then
+            count=$(ls "$pattern" 2>/dev/null | wc -l)
+            rm -f "$pattern" 2>/dev/null
             echo -e "  ${GREEN}✓${NC} Removed: $count log file(s)"
             ((cleaned_count++))
             break
diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index b90cd47..24276f7 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -226,7 +226,7 @@ install_all_scanners() {
             cd maldetect-* 2>/dev/null
             ./install.sh &>/dev/null
             cd /tmp
-            rm -rf maldetect-*
+            rm -rf "maldetect-"*
         fi
 
         if is_maldet_installed; then
diff --git a/tools/erase-toolkit-traces.sh b/tools/erase-toolkit-traces.sh
index eddc7e1..992219b 100755
--- a/tools/erase-toolkit-traces.sh
+++ b/tools/erase-toolkit-traces.sh
@@ -100,8 +100,8 @@ echo "  ✓ Download artifacts removed"
 
 # Remove toolkit temp files
 echo "→ Removing temporary files..."
-rm -rf /tmp/live-monitor-* 2>/dev/null
-rm -rf /tmp/server-toolkit-* 2>/dev/null
+rm -rf /tmp/"live-monitor-"* 2>/dev/null
+rm -rf /tmp/"server-toolkit-"* 2>/dev/null
 echo "  ✓ Temp files removed"
 
 # Clean last log and audit trails