security issues (String to char[])