Protecting against evil regular expressions