fix potential security issue with set()