better function string in shellshock_detect