Avoiding Bash for untrusted user input