avoid injection in input prompt