execve would be better since you can specify the path to the executable, and then everything else is passed as a string, so it couldn't be vunerable to things such as
system("command; bad actor code)
^ bad actor injecting in a semicolon then running a bad command