remove ';' and '&' from the command args to prevent shell code injektion