After David's explanation. Here is the better version of the code:

local fs = 'D:\\proj\\qlua100\\app\\data\\source\\orders_daily.csv'
local fd = 'D:\\proj\\qlua100\\app\\data\\source\\orders_daily.xlsx'
local command = '""csv2xls.cmd" -fs '..fs..' -fd '..fd..' --zoom 90"'
os.execute(command)

I replaced double square brackets with single quotes and added escapes for slashes. Now it is possible to use variables. Double quotes are the property of Windows CMD interpreter and must be used in this way. As far as I understand they separate the command and its parameters. This version is much better to my eyes. Thank you David for your help.