bad variable escape