check for malicious characters in command