added validation and fixed security issue with :format REGEX expression.