fix possible code injection (fix #52)