use "p" for path and protect for nul byte security issue