Avoid arbitrary code auto-injection