How to always escape user's input?

I have code which creates tcsh scripts "on the fly". The code (written in Java if it matters) gets a configuration file, parses it and then creates a tcsh script out of it. In the configuration file, there is a string that has two roles in the output tcsh script:

1. Print the command (with echo, meaning echo <string>)
2. execute the command (meaning <string>).

The code:

# Java code but it really does not matter
fw.write("echo '" + cmd + "'\n");
fw.write(cmd + "\n");

There is a problem with the cmd. For the purpose of explaining the issue, consider the following cmd:

/run/some/setup -o1 option1 -option2 '$SOME_ENV_2_EXEC -option3 hi'

# You get:
# echo /run/some/setup -o1 option1 -option2 '$SOME_ENV_2_EXEC -option3 hi'
# /run/some/setup -o1 option1 -option2 '$SOME_ENV_2_EXEC -option3 hi'

If the cmd contains ' then it will split it in three parts (first part is '/run/some/setup -o1 option1 -option2 ', second part is $SOME_ENV_2_EXEC -option3 hi and third part is ''. I also can't use " because I will get the same error if users will use " in the string. I also don't want to use without quotes because I don't want to evaluate the input. For example if we have /run/some/setup -o1 $SOME_ENV_2_EXEC, I don't want it to evaluate $SOME_ENV_2_EXEC, I want it to print the env name (You get this effect with ': echo '/run/some/setup -o1 $SOME_ENV_2_EXEC' but as we saw, we get a problem if the string itself contains '). How can I always make it work?

Bottomline, I want it to work for:

/run/some/setup -o1 option1 -option2 '$SOME_ENV_2_EXEC -option3 hi'
/run/some/setup -o1 option1 -option2 "hi"
/run/some/setup -o1 $SOME_ENV_2_EXEC

which workaround I can use here?