diff --git a/scripts/entrypoint-lsphp.sh b/scripts/entrypoint-lsphp.sh
index dffd56d..a794714 100644
--- a/scripts/entrypoint-lsphp.sh
+++ b/scripts/entrypoint-lsphp.sh
@@ -68,6 +68,25 @@ SAFE_DOMAIN="$domain"
 case "$domain" in
   \*.*) SAFE_DOMAIN="wildcard.${domain#\*.}" ;;
 esac
+
+## Both of these get interpolated into generated php.ini fragments below. They
+## are panel-validated and both already feed `ln -sfn` and the shared-ols vhost
+## config, so a hostile value is not reachable today — this is the belt to that
+## brace. A newline in $domain is an INI-DIRECTIVE INJECTION into the generated
+## fragment (measured against the pre-fix script: domain=$'evil.com\nprecision =
+## 7\n; ' put that directive in 99-cac-path-parity.ini and lsphp reported
+## `precision => 7`); `$(...)` yields an ini parse error and `"` an empty value,
+## and BOTH of those leave the
+## path-parity extension INERT — the exact silent parity loss this whole change
+## exists to eliminate. Quoting the emitted values (done below) neutralises
+## newlines and quotes; it does NOT neutralise php.ini's own `${VAR}`
+## interpolation, which is why the character class is checked as well.
+INI_TOKENS_OK=yes
+case "$user" in ''|*[!A-Za-z0-9._-]*) INI_TOKENS_OK=no ;; esac
+case "$SAFE_DOMAIN" in ''|*[!A-Za-z0-9._-]*) INI_TOKENS_OK=no ;; esac
+if [ "$INI_TOKENS_OK" != yes ]; then
+  echo "WARNING: entrypoint-lsphp: user/domain contain characters outside [A-Za-z0-9._-] — refusing to write the \$_SERVER path-parity mapping (the extension stays inert; requests are unaffected). user=$(printf '%q' "$user") domain=$(printf '%q' "$domain")" >&2
+fi
 ## The exact path prefix the shared-ols container serves this site from — the
 ## string OLS puts in SCRIPT_FILENAME/DOCUMENT_ROOT. Used twice: for the symlink
 ## that makes it RESOLVE, and for the cac_path_parity mapping that makes it READ
@@ -124,11 +143,13 @@ LSPHP_INFO=$("$LSPHP_BIN" -i 2>/dev/null || true)
 SCAN_DIR=$(printf '%s\n' "$LSPHP_INFO" | awk -F'=> ' '/^Scan this dir/ {print $2; exit}')
 if [ -n "$SCAN_DIR" ]; then
   mkdir -p "$SCAN_DIR"
-  cat > "$SCAN_DIR/99-user-error-log.ini" <<EOF
-; rendered at container start by entrypoint-lsphp.sh
-error_log = /home/${user}/logs/php-fpm/error.log
-log_errors = On
-EOF
+  ## Values emitted double-quoted via printf rather than interpolated into an
+  ## unquoted heredoc — see the INI_TOKENS_OK note above for what that prevents.
+  {
+    echo '; rendered at container start by entrypoint-lsphp.sh'
+    printf 'error_log = "%s"\n' "/home/$user/logs/php-fpm/error.log"
+    echo 'log_errors = On'
+  } > "$SCAN_DIR/99-user-error-log.ini"
   ## ---- $_SERVER path parity with cac-fpm ----
   ## Point the cac_path_parity extension at THIS site's mapping. Same two
   ## values the compatibility symlink above is built from, so the rewrite and
@@ -142,12 +163,19 @@ EOF
   ## normaliser was itself PHP_INI_PERDIR and any site with its own prepend
   ## silently displaced it, while making OUR prepend win would have disabled
   ## THEIRS. See ext/cac-path-parity/cac_path_parity.c.
-  if printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$'; then
-    cat > "$SCAN_DIR/99-cac-path-parity.ini" <<EOF
-; rendered at container start by entrypoint-lsphp.sh
-cac_path_parity.from = ${OLS_SITE_PATH}
-cac_path_parity.to = /home/${user}
-EOF
+  if [ "$INI_TOKENS_OK" != yes ]; then
+    ## Already warned above. Write NOTHING: neither the mapping (we will not
+    ## generate ini from an unvetted string) nor the auto_prepend fallback (which
+    ## would not be correct for such a site either). The extension stays inert,
+    ## the request path is unaffected.
+    rm -f "$SCAN_DIR/99-cac-path-parity.ini" "$SCAN_DIR/99-cac-lsphp-normalize.ini"
+    PATH_PARITY_MODE="none (user/domain rejected)"
+  elif printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$'; then
+    {
+      echo '; rendered at container start by entrypoint-lsphp.sh'
+      printf 'cac_path_parity.from = "%s"\n' "$OLS_SITE_PATH"
+      printf 'cac_path_parity.to = "%s"\n'   "/home/$user"
+    } > "$SCAN_DIR/99-cac-path-parity.ini"
     ## Drop the pre-extension fallback if an older image left one here — the
     ## container filesystem survives a "docker restart", so an in-place upgrade
     ## must not keep a stale auto_prepend pointing at the old normaliser.