This seems ripe for an injection attack. Can it be inspected before running?