> "how do you plan on separating data from instructions?"

Hang on, is this basically just the same fault as SQL injection, you can force it to misinterpret a string as a command rather than an operand?

I feel like we already fixed that.