diff --git a/NEWS b/NEWS
index 33d81b34..6e135d35 100644
--- a/NEWS
+++ b/NEWS
@@ -11,7 +11,7 @@
 	* :let mapleader=","  and <Leader> in :map support
 	* added new :let and :unlet commands
 	* :b2 now allowed, no space required before the 2 anymore
-	* :! to run commands through system() (UNIX only)
+	* :! to run commands through system()
 	* separated search and Ex command history
 	* merge the existing status bar with the standard FF status bar so that
 	  security information and extension buttons are included
diff --git a/content/commands.js b/content/commands.js
index 4078061a..f5cbb629 100644
--- a/content/commands.js
+++ b/content/commands.js
@@ -1647,14 +1647,15 @@ function Commands() //{{{
             // TODO: if special, run the last command
             var output = vimperator.system(args)
             if (typeof output === "string")
-                vimperator.echo(output);
+                vimperator.echo(vimperator.util.escapeHTML(output));
             else
+                // FIXME: why are we accepting only a string return value from v.system()? -- djk
                 vimperator.echoerr("Invalid system command: " + args);
         },
         {
-            usage: "!{command}",
+            usage: ["!{command}"],
             short_help: "Run a command",
-            help: "Runs {command} through system() and displays its output." +
+            help: "Runs {command} through system() and displays its output. " +
                   "Input redirection (< foo) not done, do not run commands which require stdin or it will hang Firefox!"
         }
     ));
diff --git a/content/vimperator.js b/content/vimperator.js
index cd67e14a..a3b628de 100644
--- a/content/vimperator.js
+++ b/content/vimperator.js
@@ -582,17 +582,22 @@ const vimperator = (function() //{{{
 
         // when https://bugzilla.mozilla.org/show_bug.cgi?id=68702 is fixed
         // is fixed, should use that instead of a tmpfile
-        // TODO: make it usable on windows
         // TODO: pass "input" as stdin
         // TODO: add shell/shellcmdflag options to replace "sh" and "-c"
         system: function (str, input)
         {
+            const WINDOWS = navigator.platform == "Win32"; // FIXME: duplicated everywhere
+
             var fileout = getTempFile();
             if (!fileout)
                 return "";
 
+            if (WINDOWS)
+                var command = str + " > " + fileout.path;
+            else
+                var command = str + " > \"" + fileout.path.replace('"', '\\"') + "\"";
+
             var filein = null;
-            var command = str + " > \"" + fileout.path.replace('"', '\\"') + "\"";
             if (input)
             {
                 filein = getTempFile();
@@ -602,7 +607,11 @@ const vimperator = (function() //{{{
                 command += " < \"" + filein.path.replace('"', '\\"') + "\"";
             }
 
-            this.run("sh", ["-c", command], true);
+            if (WINDOWS)
+                this.run("cmd.exe", ["/C", command], true);
+            else
+                this.run("sh", ["-c", command], true);
+
             var fd = vimperator.fopen(fileout, "<");
             if (!fd)
                 return null;