prevent code injection
Merge pull request #415 from Trott/prevent-code-injection

prevent code injection