Use snprintf to prevent buffer overrun