Secure scanf (nscanf)