It may be simple, but you need to be very, very, careful to not be fooled by file names which look like %7C%20/path/to/evil/cmd. Caveat programmer...