bugfix: $ and backslashes blacklisted