A safer string for C