security fix when using fuel_var to prevent the execution of php code in a variable by default