It is recommended that untrusted data is never used to form a command
to be executed by the OS.

To validate data, the application should
ensure that the supplied value contains only the characters that are
required to perform the required action.

For example, where the form
field expects an IP address, only numbers and periods should be
accepted. Additionally, all control operators (`&`, `&&`, `|`, `||`,
`$`, `\`, `#`) should be explicitly denied and never accepted as valid
input by the server.