WebUI could severely break users systems, please escape the registration code

I've found my pwgen generated registration key to break your really nice "this is how you attach" info page.

What I got was a registration code that included a ` and due to that was considered a subcommand.

I assume you already try to avoid some of it via the rule of "Trailing spaces or ; or # symbols are not allowed." but IMHO it is not enough.

Worst case an attacker could set the registration key to interesting things and wreak havoc.
Example bad registration keys:
- 123`ls /boot`
- 123$(ls /boot)

Both would currently be allowed and we all know what happens if `ls` is replaced by `rm -rf` in those.
Or how about anything that includes passwd, ssh-import-id or sending data somewhere.
I guess you got my point.

Basic recommendation (you are free to resolve otherwise) of me would be to also prohibit the use of ' and always display the registration code inside of those like 'code'.