diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java
index 2f57490b5f..8bae24dc05 100644
--- a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java
+++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java
@@ -60,7 +60,8 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
             a1 = "sh";
             a2 = "-c";
         }
-        String[] args = {a1, a2, "echo " + bar};
+        String sanitizedBar = sanitizeInput(bar);
+        String[] args = {a1, a2, "echo " + sanitizedBar};
 
         ProcessBuilder pb = new ProcessBuilder(args);
 
@@ -74,6 +75,11 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
         }
     } // end doPost
 
+    private static String sanitizeInput(String input) {
+        // Remove any character that is not alphanumeric or space
+        return input.replaceAll("[^a-zA-Z0-9 ]", "");
+    }
+
     private static String doSomething(HttpServletRequest request, String param)
             throws ServletException, IOException {
 
@@ -84,6 +90,11 @@ private static String doSomething(HttpServletRequest request, String param)
         map44.put("keyC", "another-Value"); // put some stuff in the collection
         bar = (String) map44.get("keyB-44"); // get it back out
 
-        return bar;
+        return sanitizeInput(bar);
+    }
+
+    private static String sanitizeInput(String input) {
+        // Remove any character that is not alphanumeric or space
+        return input.replaceAll("[^a-zA-Z0-9 ]", "");
     }
 }