do not allow injection attacks on X- vars