Safer string copy