fix command injection