Do not pass uncontrolled strings to sprintf