Escape input to help prevent RCE

?say=;whoami would execute whoami