Injection bug. You don't properly insert the letters into the glob pattern. I think using quotemeta on the literals will do the trick.