works--TODO: iron out malicious input