Security hole: quoting exec only post