Improper variable sanitization