plugged gaping security hole by not putting user-input into an exec() command but instead piping it to stdin
use `espeak` if say is not available
basic documentation