...
The best defense against code injection vulnerabilities is to avoid including executable user input in code. When dynamic code requires user input, that input must be sanitized. For example, a top-level method could ensure that the string firstName contains only valid, white-listed characters. Refer to the guideline IDS01-J. Sanitize before processing or storing user inputCarefully filter any data that passes through a trust boundary for more details. If special characters are allowed in the name, they must be escaped before comparing with their equivalent forms.
...