replace sprintf with snprintf for secure-coding