When constructing OS command strings, use stringent whitelists that limit the character
set based on the expected value of the parameter in the request. This will indirectly limit
the scope of an attack, but this technique is less important than proper output encoding
and escaping.