Suppose I wrote a simple program to take in a filename from…

Suppose I wrote a simple program to take in a filename from a user and then execute a command to copy that file to a particular location (e.g. my own submission directory). How could this be exploited for command injection? What security measures should be implemented to prevent it? cp user_input subfolder/