prevent unwanted code execution via CURLOPT_POSTFIELDS (again)