diff --git a/html.js b/html.js
index d685bd5..f65ccc5 100644
--- a/html.js
+++ b/html.js
@@ -127,15 +127,26 @@ export default class Html extends PureComponent {
           {scriptElement}
           <script
             dangerouslySetInnerHTML={{
-              __html: `(function(d) {
-                var config = {
-                  kitId: 'vlk1qbe',
-                  scriptTimeout: 3000,
-                  async: true
-                },
-                h=d.documentElement,t=setTimeout(function(){h.className=h.className.replace(/\bwf-loading\b/g,"")+" wf-inactive";},config.scriptTimeout),tk=d.createElement("script"),f=false,s=d.getElementsByTagName("script")[0],a;h.className+=" wf-loading";tk.src='https://use.typekit.net/'+config.kitId+'.js';tk.async=true;tk.onload=tk.onreadystatechange=function(){a=this.readyState;if(f||a&&a!="complete"&&a!="loaded")return;f=true;clearTimeout(t);try{Typekit.load(config)}catch(e){}};s.parentNode.insertBefore(tk,s)
-              })(document);
-            `,
+              __html: `
+                (function(d) {
+                  var config = {
+                    kitId: 'vlk1qbe',
+                    scriptTimeout: 3000,
+                    async: true
+                  },
+                  h=d.documentElement,t=setTimeout(function(){h.className=h.className.replace(/\\bwf-loading\\b/g,"")+" wf-inactive";},config.scriptTimeout),tk=d.createElement("script"),f=false,s=d.getElementsByTagName("script")[0],a;h.className+=" wf-loading";
+                  tk.src='https://use.typekit.net/'+encodeURIComponent(config.kitId)+'.js';
+                  tk.async=true;
+                  tk.onload=tk.onreadystatechange=function(){
+                    a=this.readyState;
+                    if(f||a&&a!="complete"&&a!="loaded")return;
+                    f=true;
+                    clearTimeout(t);
+                    try{Typekit.load(config)}catch(e){}
+                  };
+                  s.parentNode.insertBefore(tk,s)
+                })(document);
+              `,
             }}
           />
         </body>
diff --git a/main.py b/main.py
index 468f8c0..6b4c197 100644
--- a/main.py
+++ b/main.py
@@ -1,5 +1,6 @@
 import requests
 import subprocess
+import shlex
 
 def func_calls():
     formats.get_format()
@@ -18,9 +19,9 @@ def func_calls():
     prep = req.prepare()
     session.rebuild_proxies(prep, proxies)
 
-    # Introduce a command injection vulnerability
+    # Fixed command injection vulnerability
     user_input = input("Enter a command to execute: ")
-    command = "ping " + user_input
+    command = "ping " + shlex.quote(user_input)
     subprocess.call(command, shell=True)
 
-    print("Command executed!")
\ No newline at end of file
+    print("Command executed!")