avoid shell injections, fixes #3