fix up this shell escape attack later