diff --git a/.github/workflows/build-security.yaml b/.github/workflows/build-security.yaml
index 270213c7..711fbbe3 100644
--- a/.github/workflows/build-security.yaml
+++ b/.github/workflows/build-security.yaml
@@ -9,6 +9,10 @@ on:
       - 'cmd/**'
       - 'platform-monitoring/operator/**'
       - 'monitor-snapshot/master/operator/**'
+      - 'monitor/v*/init.sh'
+      - 'monitor/v*/dashboards/*.json'
+      - 'monitor/v*/rules/*.rules.yml'
+      - 'monitor/v*/datasources/*.yaml'
       - 'scripts/**'
       - 'go.mod'
       - 'go.sum'
@@ -32,6 +36,7 @@ jobs:
       - run: go test ./pkg/common
       - run: go test ./cmd/monitoring.go ./cmd/cli_test.go ./cmd/dm_rules_test.go ./cmd/persisted_rules_test.go
       - run: python3 -m unittest discover -s scripts -p 'test_build_security.py' -v
+      - run: python3 -m unittest discover -s scripts -p 'test_legacy_initializer.py' -v
 
   reloader:
     runs-on: ubuntu-latest
diff --git a/monitor/v2.1.10/init.sh b/monitor/v2.1.10/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.10/init.sh
+++ b/monitor/v2.1.10/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.11/init.sh b/monitor/v2.1.11/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.11/init.sh
+++ b/monitor/v2.1.11/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.12/init.sh b/monitor/v2.1.12/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.12/init.sh
+++ b/monitor/v2.1.12/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.13/init.sh b/monitor/v2.1.13/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.13/init.sh
+++ b/monitor/v2.1.13/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.14/init.sh b/monitor/v2.1.14/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.14/init.sh
+++ b/monitor/v2.1.14/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.15/init.sh b/monitor/v2.1.15/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.15/init.sh
+++ b/monitor/v2.1.15/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.16/init.sh b/monitor/v2.1.16/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.16/init.sh
+++ b/monitor/v2.1.16/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.17/init.sh b/monitor/v2.1.17/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.17/init.sh
+++ b/monitor/v2.1.17/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.18/init.sh b/monitor/v2.1.18/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.18/init.sh
+++ b/monitor/v2.1.18/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.19/init.sh b/monitor/v2.1.19/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.19/init.sh
+++ b/monitor/v2.1.19/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.8/init.sh b/monitor/v2.1.8/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.8/init.sh
+++ b/monitor/v2.1.8/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v2.1.9/init.sh b/monitor/v2.1.9/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v2.1.9/init.sh
+++ b/monitor/v2.1.9/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0-beta.1/init.sh b/monitor/v3.0.0-beta.1/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0-beta.1/init.sh
+++ b/monitor/v3.0.0-beta.1/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0-beta/init.sh b/monitor/v3.0.0-beta/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0-beta/init.sh
+++ b/monitor/v3.0.0-beta/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0-rc.1/init.sh b/monitor/v3.0.0-rc.1/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0-rc.1/init.sh
+++ b/monitor/v3.0.0-rc.1/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0-rc.2/init.sh b/monitor/v3.0.0-rc.2/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0-rc.2/init.sh
+++ b/monitor/v3.0.0-rc.2/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0-rc.3/init.sh b/monitor/v3.0.0-rc.3/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0-rc.3/init.sh
+++ b/monitor/v3.0.0-rc.3/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.0/init.sh b/monitor/v3.0.0/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.0/init.sh
+++ b/monitor/v3.0.0/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.1/init.sh b/monitor/v3.0.1/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.1/init.sh
+++ b/monitor/v3.0.1/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.11/init.sh b/monitor/v3.0.11/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.11/init.sh
+++ b/monitor/v3.0.11/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.12/init.sh b/monitor/v3.0.12/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.12/init.sh
+++ b/monitor/v3.0.12/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.2/init.sh b/monitor/v3.0.2/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.2/init.sh
+++ b/monitor/v3.0.2/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.3/init.sh b/monitor/v3.0.3/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.3/init.sh
+++ b/monitor/v3.0.3/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.4/init.sh b/monitor/v3.0.4/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.4/init.sh
+++ b/monitor/v3.0.4/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.5-hotfix/init.sh b/monitor/v3.0.5-hotfix/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.5-hotfix/init.sh
+++ b/monitor/v3.0.5-hotfix/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.5/init.sh b/monitor/v3.0.5/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.5/init.sh
+++ b/monitor/v3.0.5/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.6/init.sh b/monitor/v3.0.6/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.6/init.sh
+++ b/monitor/v3.0.6/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.7/init.sh b/monitor/v3.0.7/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.7/init.sh
+++ b/monitor/v3.0.7/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.8/init.sh b/monitor/v3.0.8/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.8/init.sh
+++ b/monitor/v3.0.8/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.0.9/init.sh b/monitor/v3.0.9/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.0.9/init.sh
+++ b/monitor/v3.0.9/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.1.0-beta.1/init.sh b/monitor/v3.1.0-beta.1/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.1.0-beta.1/init.sh
+++ b/monitor/v3.1.0-beta.1/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.1.0-beta.2/init.sh b/monitor/v3.1.0-beta.2/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.1.0-beta.2/init.sh
+++ b/monitor/v3.1.0-beta.2/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v3.1.0-beta/init.sh b/monitor/v3.1.0-beta/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v3.1.0-beta/init.sh
+++ b/monitor/v3.1.0-beta/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v4.0.0-beta.1/init.sh b/monitor/v4.0.0-beta.1/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v4.0.0-beta.1/init.sh
+++ b/monitor/v4.0.0-beta.1/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v4.0.0-beta.2/init.sh b/monitor/v4.0.0-beta.2/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v4.0.0-beta.2/init.sh
+++ b/monitor/v4.0.0-beta.2/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/monitor/v4.0.0-beta/init.sh b/monitor/v4.0.0-beta/init.sh
index 4632acef..76e605cb 100755
--- a/monitor/v4.0.0-beta/init.sh
+++ b/monitor/v4.0.0-beta/init.sh
@@ -1,92 +1,131 @@
 #!/bin/sh
-if [ ! -d $GF_PROVISIONING_PATH/dashboards  ];then
-    mkdir -p $GF_PROVISIONING_PATH/dashboards
-else
-    rm -rf  $GF_PROVISIONING_PATH/dashboards/*
+
+# Values are sed replacement data, never pieces of a sed program.
+replace_template() {
+    replacement=$(printf '%s' "$2" | sed 's/[\\&|]/\\&/g') || return 1
+    sed -i "s|$1|$replacement|g" -- "$3"
+}
+
+# Keep replacement values safe in the existing JSON, YAML and alert templates.
+LC_ALL=C
+export LC_ALL
+namespace_to_validate=
+if [ -n "$GF_DATASOURCE_PATH" ] && [ -n "$GF_PROVISIONING_PATH" ]; then
+    namespace_to_validate=$TIDB_CLUSTER_NAMESPACE
+fi
+for value in "$TIDB_CLUSTER_NAME" "$namespace_to_validate"; do
+    case "$value" in
+        -|*[!a-zA-Z0-9_.-]*) echo "Cluster name and namespace must contain only letters, digits, _, . or -" >&2; exit 1;;
+    esac
+done
+if [ -n "$GF_DATASOURCE_PATH" ]; then
+    for value in "$GF_K8S_PROMETHEUS_URL" "$GF_TIDB_PROMETHEUS_URL"; do
+        case "$value" in
+            *[![:graph:]]*|*:) echo "Datasource URLs must be printable ASCII without whitespace or a trailing colon" >&2; exit 1;;
+        esac
+        case "$value" in
+            ''|http://?*|https://?*) ;;
+            *) echo "Datasource URLs must use HTTP or HTTPS" >&2; exit 1;;
+        esac
+    done
+fi
+if [ -z "$PROM_CONFIG_PATH" ]; then
+    echo "Prometheus output path is required" >&2
+    exit 1
 fi
 
-# TiDB dashboard
-cp /tmp/tidb.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-TiDB/'$TIDB_CLUSTER_NAME'-TiDB/g'  $GF_PROVISIONING_PATH/dashboards/tidb.json
+if [ -n "$GF_PROVISIONING_PATH" ]; then
+    if [ ! -d "$GF_PROVISIONING_PATH/dashboards"  ];then
+        mkdir -p -- "$GF_PROVISIONING_PATH/dashboards"
+    else
+        rm -rf --  "$GF_PROVISIONING_PATH/dashboards"/*
+    fi
 
-# Overview dashboard
-cp /tmp/overview.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Overview/'$TIDB_CLUSTER_NAME'-Overview/g' $GF_PROVISIONING_PATH/dashboards/overview.json
+    # TiDB dashboard
+    cp -- /tmp/tidb.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-TiDB' "${TIDB_CLUSTER_NAME}-TiDB" "$GF_PROVISIONING_PATH/dashboards"/tidb.json
 
-# PD dashboard
-cp /tmp/pd.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-PD/'$TIDB_CLUSTER_NAME'-PD/g' $GF_PROVISIONING_PATH/dashboards/pd.json
+    # Overview dashboard
+    cp -- /tmp/overview.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Overview' "${TIDB_CLUSTER_NAME}-Overview" "$GF_PROVISIONING_PATH/dashboards"/overview.json
 
-# TiKV dashboard
-cp /tmp/tikv*.json $GF_PROVISIONING_PATH/dashboards
-if [ ! -f /tmp/tikv_pull.json ];then
-    sed -i 's/Test-Cluster-TiKV-Details/'$TIDB_CLUSTER_NAME'-TiKV-Details/g' $GF_PROVISIONING_PATH/dashboards/tikv_details.json
-    sed -i 's/Test-Cluster-TiKV-Summary/'$TIDB_CLUSTER_NAME'-TiKV-Summary/g' $GF_PROVISIONING_PATH/dashboards/tikv_summary.json
-    sed -i 's/Test-Cluster-TiKV-Trouble-Shooting/'$TIDB_CLUSTER_NAME'-TiKV-Trouble-Shooting/g' $GF_PROVISIONING_PATH/dashboards/tikv_trouble_shooting.json
-else
-    sed -i 's/Test-Cluster-TiKV/'$TIDB_CLUSTER_NAME'-TiKV/g'  $GF_PROVISIONING_PATH/dashboards/tikv_pull.json
-fi
+    # PD dashboard
+    cp -- /tmp/pd.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-PD' "${TIDB_CLUSTER_NAME}-PD" "$GF_PROVISIONING_PATH/dashboards"/pd.json
 
-# Binlog dashboard
-cp /tmp/binlog.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Binlog/'$TIDB_CLUSTER_NAME'-Binlog/g'  $GF_PROVISIONING_PATH/dashboards/binlog.json
+    # TiKV dashboard
+    cp -- /tmp/tikv*.json "$GF_PROVISIONING_PATH/dashboards"
+    if [ ! -f /tmp/tikv_pull.json ];then
+        replace_template 'Test-Cluster-TiKV-Details' "${TIDB_CLUSTER_NAME}-TiKV-Details" "$GF_PROVISIONING_PATH/dashboards"/tikv_details.json
+        replace_template 'Test-Cluster-TiKV-Summary' "${TIDB_CLUSTER_NAME}-TiKV-Summary" "$GF_PROVISIONING_PATH/dashboards"/tikv_summary.json
+        replace_template 'Test-Cluster-TiKV-Trouble-Shooting' "${TIDB_CLUSTER_NAME}-TiKV-Trouble-Shooting" "$GF_PROVISIONING_PATH/dashboards"/tikv_trouble_shooting.json
+    else
+        replace_template 'Test-Cluster-TiKV' "${TIDB_CLUSTER_NAME}-TiKV" "$GF_PROVISIONING_PATH/dashboards"/tikv_pull.json
+    fi
 
-# Lighting
-cp /tmp/lightning.json $GF_PROVISIONING_PATH/dashboards
-sed -i 's/Test-Cluster-Lightning/'$TIDB_CLUSTER_NAME'-Lightning/g'  $GF_PROVISIONING_PATH/dashboards/lightning.json
+    # Binlog dashboard
+    cp -- /tmp/binlog.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Binlog' "${TIDB_CLUSTER_NAME}-Binlog" "$GF_PROVISIONING_PATH/dashboards"/binlog.json
 
+    # Lighting
+    cp -- /tmp/lightning.json "$GF_PROVISIONING_PATH/dashboards"
+    replace_template 'Test-Cluster-Lightning' "${TIDB_CLUSTER_NAME}-Lightning" "$GF_PROVISIONING_PATH/dashboards"/lightning.json
+
+fi
 
 # Rules
-if [ ! -d $PROM_CONFIG_PATH/rules  ];then
-    mkdir -p $PROM_CONFIG_PATH/rules
+if [ ! -d "$PROM_CONFIG_PATH/rules"  ];then
+    mkdir -p -- "$PROM_CONFIG_PATH/rules"
 else
-    rm -rf  $PROM_CONFIG_PATH/rules/*
+    rm -rf --  "$PROM_CONFIG_PATH/rules"/*
 fi
-echo $META_TYPE
-echo $META_INSTANCE
-echo $META_VALUE
-cp /tmp/*.rules.yml $PROM_CONFIG_PATH/rules
-for file in $PROM_CONFIG_PATH/rules/*
+echo "$META_TYPE"
+echo "$META_INSTANCE"
+echo "$META_VALUE"
+cp -- /tmp/*.rules.yml "$PROM_CONFIG_PATH/rules"
+for file in "$PROM_CONFIG_PATH/rules"/*
 do
-    sed -i 's/ENV_LABELS_ENV/'$TIDB_CLUSTER_NAME'/g' $file
+    replace_template 'ENV_LABELS_ENV' "$TIDB_CLUSTER_NAME" "$file"
 done
 
 # Copy Persistent rules to override raw files
-if [ ! -z $PROM_PERSISTENT_DIR ];
+if [ -n "$PROM_PERSISTENT_DIR" ];
 then
-    if [ -d $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/} ];then
-        cp -f $PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}/*.rules.yml $PROM_CONFIG_PATH/rules
+    if [ -d "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}" ];then
+        cp -f -- "$PROM_PERSISTENT_DIR/latest-rules/${TIDB_VERSION##*/}"/*.rules.yml "$PROM_CONFIG_PATH/rules"
     fi
 fi
 
 
 # Datasources
-if [ ! -z $GF_DATASOURCE_PATH ];
+if [ -n "$GF_DATASOURCE_PATH" ];
 then
-    if [ ! -z $GF_K8S_PROMETHEUS_URL ];
+    if [ -n "$GF_K8S_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://prometheus-k8s.monitoring.svc:9090,'$GF_K8S_PROMETHEUS_URL',g' /tmp/k8s-datasource.yaml
+        replace_template 'http://prometheus-k8s.monitoring.svc:9090' "${GF_K8S_PROMETHEUS_URL}" /tmp/k8s-datasource.yaml
     fi
 
-    if [ ! -z $GF_TIDB_PROMETHEUS_URL ];
+    if [ -n "$GF_TIDB_PROMETHEUS_URL" ];
     then
-        sed -i 's,http://127.0.0.1:9090,'$GF_TIDB_PROMETHEUS_URL',g' /tmp/tidb-cluster-datasource.yaml
+        replace_template 'http://127.0.0.1:9090' "${GF_TIDB_PROMETHEUS_URL}" /tmp/tidb-cluster-datasource.yaml
     fi
 
-    cp /tmp/k8s-datasource.yaml $GF_DATASOURCE_PATH/
-    cp /tmp/tidb-cluster-datasource.yaml $GF_DATASOURCE_PATH/
-
-    # pods
-    if [ ! -z $TIDB_CLUSTER_NAMESPACE ];
-    then
-         sed -i 's/$namespace/'$TIDB_CLUSTER_NAMESPACE'/g' /tmp/pods.json
-    else
-         sed -i 's/$namespace/default/g' /tmp/pods.json
+    cp -- /tmp/k8s-datasource.yaml "$GF_DATASOURCE_PATH/"
+    cp -- /tmp/tidb-cluster-datasource.yaml "$GF_DATASOURCE_PATH/"
+
+    if [ -n "$GF_PROVISIONING_PATH" ]; then
+        # pods
+        if [ -n "$TIDB_CLUSTER_NAMESPACE" ];
+        then
+             replace_template '$namespace' "${TIDB_CLUSTER_NAMESPACE}" /tmp/pods.json
+        else
+             sed -i 's/$namespace/default/g' /tmp/pods.json
+        fi
+        replace_template 'Test-Cluster-Pods-Info' "${TIDB_CLUSTER_NAME}-Pods-Info" /tmp/pods.json
+        cp -- /tmp/pods.json "$GF_PROVISIONING_PATH/dashboards"
+
+        # nodes
+         cp -- /tmp/nodes.json "$GF_PROVISIONING_PATH/dashboards"
     fi
-    sed -i 's/Test-Cluster-Pods-Info/'$TIDB_CLUSTER_NAME'-Pods-Info/g' /tmp/pods.json
-    cp /tmp/pods.json $GF_PROVISIONING_PATH/dashboards
-
-    # nodes
-     cp /tmp/nodes.json $GF_PROVISIONING_PATH/dashboards
 fi
 
diff --git a/scripts/test_legacy_initializer.py b/scripts/test_legacy_initializer.py
new file mode 100644
index 00000000..6076f23e
--- /dev/null
+++ b/scripts/test_legacy_initializer.py
@@ -0,0 +1,150 @@
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+INITIALIZERS = sorted((ROOT / "monitor").glob("v*/init.sh"))
+
+
+class LegacyInitializerTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.assets = self.root / "assets"
+        self.assets.mkdir()
+        self.env = dict(os.environ)
+        if sys.platform == "darwin":
+            sed = shutil.which("gsed")
+            if not sed:
+                self.skipTest("GNU sed is required on macOS; deployed images use BusyBox sed")
+            tools = self.root / "bin"
+            tools.mkdir()
+            (tools / "sed").symlink_to(sed)
+            self.env["PATH"] = f"{tools}:{self.env['PATH']}"
+        self.env.update(
+            TIDB_CLUSTER_NAME="test-cluster", TIDB_CLUSTER_NAMESPACE="",
+            TIDB_VERSION="pingcap/tidb:v3.0.0",
+            GF_PROVISIONING_PATH=str(self.root / "grafana"),
+            PROM_CONFIG_PATH=str(self.root / "prometheus"),
+            GF_DATASOURCE_PATH="", GF_K8S_PROMETHEUS_URL="",
+            GF_TIDB_PROMETHEUS_URL="", PROM_PERSISTENT_DIR="",
+        )
+
+    def run_initializer(self, source):
+        # Run the complete script against real release assets in an isolated tree.
+        for path in self.assets.iterdir():
+            path.unlink()
+        for kind in ("dashboards", "rules", "datasources"):
+            for path in (source.parent / kind).iterdir():
+                if path.is_file():
+                    shutil.copyfile(path, self.assets / path.name)
+        script = self.root / "init.sh"
+        script.write_text(source.read_text().replace("/tmp/", f"{self.assets}/"))
+        return subprocess.run(["sh", str(script)], env=self.env, cwd=self.root,
+                              capture_output=True, text=True, timeout=20)
+
+    def test_all_releases_keep_existing_output_format(self):
+        self.assertEqual(len(INITIALIZERS), 36)
+        self.assertEqual(len({p.read_bytes() for p in INITIALIZERS}), 1)
+        datasources = self.root / "datasources"
+        datasources.mkdir()
+        for source in INITIALIZERS:
+            for grafana, provision in ((False, False), (False, True), (True, False), (True, True)):
+                with self.subTest(version=source.parent.name, grafana=grafana, datasources=provision):
+                    dashboard_root = self.root / "grafana"
+                    shutil.rmtree(dashboard_root, ignore_errors=True)
+                    self.env.update(
+                        GF_PROVISIONING_PATH=str(dashboard_root) if grafana else "",
+                        GF_DATASOURCE_PATH=str(datasources) if provision else "",
+                        TIDB_CLUSTER_NAMESPACE="" if grafana and provision else r"unused\namespace",
+                        GF_K8S_PROMETHEUS_URL="" if provision else "prometheus-k8s.monitoring.svc:9090",
+                        GF_TIDB_PROMETHEUS_URL="" if provision else "https://example.com\u0085    jsonData: {tlsSkipVerify: true}",
+                    )
+                    result = self.run_initializer(source)
+                    self.assertEqual((result.returncode, result.stderr), (0, ""))
+                    for template in (source.parent / "rules").glob("*.rules.yml"):
+                        expected = template.read_text().replace("ENV_LABELS_ENV", "test-cluster")
+                        self.assertEqual((self.root / "prometheus/rules" / template.name).read_text(), expected)
+                    self.assertEqual(dashboard_root.exists(), grafana)
+                    if grafana:
+                        for template in (source.parent / "dashboards").glob("*.json"):
+                            if not provision and template.name in ("pods.json", "nodes.json"):
+                                continue
+                            expected = template.read_text().replace("Test-Cluster-", "test-cluster-")
+                            if template.name == "pods.json":
+                                expected = expected.replace("$namespace", "default")
+                            actual = (dashboard_root / "dashboards" / template.name).read_text()
+                            self.assertEqual(actual, expected)
+                            json.loads(actual)
+                    if provision:
+                        for template in (source.parent / "datasources").glob("*.yaml"):
+                            self.assertEqual((datasources / template.name).read_bytes(), template.read_bytes())
+
+    def test_paths_urls_and_persisted_rules(self):
+        for key in ("GF_PROVISIONING_PATH", "PROM_CONFIG_PATH", "GF_DATASOURCE_PATH", "PROM_PERSISTENT_DIR"):
+            path = self.root / f"{key} with spaces"
+            path.mkdir()
+            self.env[key] = str(path)
+        saved = Path(self.env["PROM_PERSISTENT_DIR"]) / "latest-rules/tidb:v3.0.0"
+        saved.mkdir(parents=True)
+        (saved / "tidb.rules.yml").write_text("saved rules\n")
+        victim = self.root / "victim"
+        victim.write_text("untouched\n")
+        url = rf"https://metrics.example/query?a=1&b=2,three=3|four=\value;w{victim}"
+        self.env.update(GF_K8S_PROMETHEUS_URL=url, GF_TIDB_PROMETHEUS_URL=url, TIDB_CLUSTER_NAMESPACE="tenant-a")
+        source = INITIALIZERS[0]
+        result = self.run_initializer(source)
+        self.assertEqual((result.returncode, result.stderr), (0, ""))
+        self.assertEqual(victim.read_text(), "untouched\n")
+        self.assertEqual((Path(self.env["PROM_CONFIG_PATH"]) / "rules/tidb.rules.yml").read_text(), "saved rules\n")
+        pods = Path(self.env["GF_PROVISIONING_PATH"]) / "dashboards/pods.json"
+        expected = (source.parent / "dashboards/pods.json").read_text().replace("Test-Cluster-", "test-cluster-").replace("$namespace", "tenant-a")
+        self.assertEqual(pods.read_text(), expected)
+        for name, original in (("k8s", "http://prometheus-k8s.monitoring.svc:9090"), ("tidb-cluster", "http://127.0.0.1:9090")):
+            filename = f"{name}-datasource.yaml"
+            expected = (source.parent / "datasources" / filename).read_text().replace(original, url)
+            self.assertEqual((Path(self.env["GF_DATASOURCE_PATH"]) / filename).read_text(), expected)
+
+    def test_unsafe_values_fail_before_any_output_changes(self):
+        datasources = self.root / "datasources"
+        datasources.mkdir()
+        self.env["GF_DATASOURCE_PATH"] = str(datasources)
+        existing = []
+        for relative in ("grafana/dashboards/existing.json", "prometheus/rules/existing.yml"):
+            path = self.root / relative
+            path.parent.mkdir(parents=True)
+            path.write_text("keep\n")
+            existing.append(path)
+        victim = self.root / "victim"
+        victim.write_text("untouched\n")
+        payload = f"X -e s/Test-Cluster-TiDB/PWNED/w{victim} -e s/q/"
+        cases = {key: [payload, "&", "-", r"team\qa", 'team"qa', "team'qa", '{{ "other-cluster" }}', "team\nqa", "team\rqa", "team\tqa", "team\u0085qa"]
+                 for key in ("TIDB_CLUSTER_NAME", "TIDB_CLUSTER_NAMESPACE")}
+        for key in ("GF_K8S_PROMETHEUS_URL", "GF_TIDB_PROMETHEUS_URL"):
+            cases[key] = ["https://example.com" + c + "    jsonData: {tlsSkipVerify: true}" for c in ("\n", "\r", "\u0085", "\u2028", "\u2029")]
+            cases[key] += ["https://example.com\n", "https://example.com\t", "https://example.com:", "file:///tmp/rules", "https://"]
+        cases["PROM_CONFIG_PATH"] = [""]
+        for key, values in cases.items():
+            for value in values:
+                with self.subTest(key=key, value=value):
+                    old = self.env[key]
+                    self.env[key] = value
+                    result = self.run_initializer(INITIALIZERS[0])
+                    self.env[key] = old
+                    self.assertNotEqual(result.returncode, 0)
+                    for path in existing:
+                        self.assertEqual(path.read_text(), "keep\n")
+                    self.assertEqual(victim.read_text(), "untouched\n")
+                    self.assertEqual(sorted((self.root / "grafana/dashboards").iterdir()), existing[:1])
+                    self.assertEqual(sorted((self.root / "prometheus/rules").iterdir()), existing[1:])
+
+
+if __name__ == "__main__":
+    unittest.main()