I wasn't aware that substr is not secure... | Substr