It is recommended that untrusted data is never used to form a command
to be executed by the OS.

To validate data, the application should ensure that the supplied value 
contains only the characters that are required to perform the
required action.

For example, where the form field expects an IP address, only numbers
and periods should be accepted. Additionally, all control operators
(`&`, `&&`, `|`, `||`, `$`, `\`, `#`) should be explicitly denied
and never accepted as valid input by the server.