make the import selector bash-injection proof