diff --git a/src/_h5ai/client/js/inc/ext/download.js b/src/_h5ai/client/js/inc/ext/download.js
index bb882992..6b5cf4e9 100644
--- a/src/_h5ai/client/js/inc/ext/download.js
+++ b/src/_h5ai/client/js/inc/ext/download.js
@@ -63,7 +63,7 @@ modulejs.define('ext/download', ['_', '$', 'core/settings', 'core/resource', 'co
 				selectedHrefsStr = _.map(items, function (item) {
 
 					return item.absHref;
-				}).join(':');
+				}).join('|:|');
 				$download.appendTo('#navbar').show();
 			} else {
 				$download.hide();
@@ -82,9 +82,9 @@ modulejs.define('ext/download', ['_', '$', 'core/settings', 'core/resource', 'co
 			} else if (exe === 'SHELL') {
 
 				var query = '?action=passArchive';
-				query += '&as=' + (settings.packageName || location.getItem().label) + '.' + settings.format;
+				query += '&as=' + encodeURIComponent((settings.packageName || location.getItem().label) + '.' + settings.format);
 				query += '&format=' + settings.format;
-				query += '&hrefs=' + selectedHrefsStr;
+				query += '&hrefs=' + encodeURIComponent(selectedHrefsStr);
 				window.location = query;
 			}
 		},
diff --git a/src/_h5ai/conf/options.json b/src/_h5ai/conf/options.json
index fc70051b..deb35704 100644
--- a/src/_h5ai/conf/options.json
+++ b/src/_h5ai/conf/options.json
@@ -105,7 +105,7 @@ Options
 	*/
 	"download": {
 		"enabled": true,
-		"execution": "php",
+		"execution": "shell",
 		"format": "tar",
 		"packageName": null
 	},
diff --git a/src/_h5ai/server/php/inc/Api.php b/src/_h5ai/server/php/inc/Api.php
index 327f3ef9..cce34364 100644
--- a/src/_h5ai/server/php/inc/Api.php
+++ b/src/_h5ai/server/php/inc/Api.php
@@ -109,7 +109,7 @@ class Api {
 			normalized_require_once("/server/php/inc/Archive.php");
 			$archive = new Archive($this->app);
 
-			$hrefs = explode(":", trim($hrefs));
+			$hrefs = explode("|:|", trim($hrefs));
 			$target = $archive->create($format, $hrefs);
 
 			if (!is_string($target)) {
@@ -160,7 +160,7 @@ class Api {
 			normalized_require_once("/server/php/inc/Archive.php");
 			$archive = new Archive($this->app);
 
-			$hrefs = explode(":", trim($hrefs));
+			$hrefs = explode("|:|", trim($hrefs));
 
 			header("Content-Type: application/octet-stream");
 			header("Content-Disposition: attachment; filename=\"$as\"");
@@ -206,7 +206,7 @@ class Api {
 
 			list($hrefs) = use_request_params(array("hrefs"));
 
-			$hrefs = explode(":", trim($hrefs));
+			$hrefs = explode("|:|", trim($hrefs));
 			$errors = array();
 
 			foreach ($hrefs as $href) {