Are there any attack cases for this command string? How are both %s instances sanitized?