 The best solution in this case is to use a whitelist of accepted language parameters.If a strong method of input validation such as a whitelist cannot be used, then rely upon input filtering or validation of the passed-in path to make sure it does not contain unintended characters and character patterns.However, this may require anticipating all possible problematic character combinations.