Security Issue: escape user-provided $login