diff --git a/setup-docker.sh b/setup-docker.sh
index 3e066cebc..10a8add0b 100644
--- a/setup-docker.sh
+++ b/setup-docker.sh
@@ -1,36 +1,37 @@
 #!/bin/bash
+set -e
 
 echo "🐳 Setting up TorrentPier for Docker..."
 echo ""
 
 if [ ! -f .env ]; then
-    if [ -f .env.example ]; then
-        cp .env.example .env
-        echo "✅ Created .env from .env.example"
-    else
-        echo "❌ Error: .env.example not found!"
-        exit 1
-    fi
+   if [ -f .env.example ]; then
+       cp .env.example .env
+       echo "✅ Created .env from .env.example"
+   else
+       echo "❌ Error: .env.example not found!"
+       exit 1
+   fi
 else
-    echo "ℹ️  .env file already exists, updating for Docker..."
+   echo "ℹ️  .env file already exists, updating for Docker..."
 fi
 
 cp .env .env.backup
 echo "💾 Backup created: .env.backup"
 
 # Enable server-side cron
-if grep -q "APP_CRON_ENABLED=true" .env; then
-    sed -i 's/APP_CRON_ENABLED=true/APP_CRON_ENABLED=false/' .env
+if grep -q "^APP_CRON_ENABLED=true" .env; then
+   sed -i 's/^APP_CRON_ENABLED=true/APP_CRON_ENABLED=false/' .env
 fi
 
-if grep -q "DB_HOST=localhost" .env; then
-    sed -i 's/DB_HOST=localhost/DB_HOST=torrentpier-db/' .env
-    echo "✅ Updated DB_HOST for Docker"
+if grep -q "^DB_HOST=localhost" .env; then
+   sed -i 's/^DB_HOST=localhost/DB_HOST=torrentpier-db/' .env
+   echo "✅ Updated DB_HOST for Docker"
 fi
 
-if grep -q "DB_USERNAME=root" .env; then
-    sed -i 's/DB_USERNAME=root/DB_USERNAME=torrentpier_user/' .env
-    echo "✅ Updated DB_USERNAME to torrentpier_user"
+if grep -q "^DB_USERNAME=root" .env; then
+   sed -i 's/^DB_USERNAME=root/DB_USERNAME=torrentpier_user/' .env
+   echo "✅ Updated DB_USERNAME to torrentpier_user"
 fi
 
 echo ""
@@ -38,39 +39,46 @@ read -s -p "🔐 Enter database password for 'torrentpier_user': " DB_PASSWORD
 echo ""
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo "❌ Error: Database password cannot be empty!"
-    exit 1
+   echo "❌ Error: Database password cannot be empty!"
+   exit 1
 fi
 
-ESCAPED_PASSWORD=$(printf '%s\n' "$DB_PASSWORD" | sed 's/[&/\]/\\&/g')
+# More robust password escaping for sed
+ESCAPED_PASSWORD=$(printf '%s\n' "$DB_PASSWORD" | sed 's/[[\.*^$()+?{|]/\\&/g')
 
-if grep -q "DB_PASSWORD=" .env; then
-    sed -i "s|DB_PASSWORD=.*|DB_PASSWORD=$ESCAPED_PASSWORD|" .env
-    echo "✅ Updated DB_PASSWORD in .env"
+if grep -q "^DB_PASSWORD=" .env; then
+   sed -i "s/^DB_PASSWORD=.*/DB_PASSWORD=$ESCAPED_PASSWORD/" .env
+   echo "✅ Updated DB_PASSWORD in .env"
 else
-    echo "DB_PASSWORD=$DB_PASSWORD" >> .env
-    echo "✅ Added DB_PASSWORD to .env"
+   echo "DB_PASSWORD=$DB_PASSWORD" >> .env
+   echo "✅ Added DB_PASSWORD to .env"
 fi
 
 echo ""
 read -p "🌐 Enter your host (IP or domain, e.g. 192.168.1.100 or example.com): " TP_HOST
+echo ""
 
 if [ -z "$TP_HOST" ]; then
-    echo ""
-    echo "❌ Error: Host cannot be empty!"
-    exit 1
+   echo "❌ Error: Host cannot be empty!"
+   exit 1
+fi
+
+# Basic validation for host format
+if [[ ! "$TP_HOST" =~ ^[a-zA-Z0-9.-]+$ ]]; then
+   echo "❌ Error: Invalid host format! Use only letters, numbers, dots, and hyphens."
+   exit 1
 fi
 
 TP_HOST=$(echo "$TP_HOST" | sed -E 's|^https?://||')
 TP_HOST=$(echo "$TP_HOST" | sed 's|/||g')
-ESCAPED_HOST=$(printf '%s\n' "$TP_HOST" | sed 's/[&/\]/\\&/g')
+ESCAPED_HOST=$(printf '%s\n' "$TP_HOST" | sed 's/[[\.*^$()+?{|]/\\&/g')
 
-if grep -q "TP_HOST=" .env; then
-    sed -i "s|TP_HOST=.*|TP_HOST=$ESCAPED_HOST|" .env
-    echo "✅ Updated TP_HOST to $TP_HOST"
+if grep -q "^TP_HOST=" .env; then
+   sed -i "s/^TP_HOST=.*/TP_HOST=$ESCAPED_HOST/" .env
+   echo "✅ Updated TP_HOST to $TP_HOST"
 else
-    echo "TP_HOST=$TP_HOST" >> .env
-    echo "✅ Added TP_HOST to .env"
+   echo "TP_HOST=$TP_HOST" >> .env
+   echo "✅ Added TP_HOST to .env"
 fi
 
 echo ""
@@ -84,25 +92,29 @@ read -p "🔐 Do you want to enable SSL (HTTPS)? [y/N]: " ENABLE_SSL
 ENABLE_SSL=$(echo "$ENABLE_SSL" | tr '[:upper:]' '[:lower:]')
 
 if [ "$ENABLE_SSL" = "y" ] || [ "$ENABLE_SSL" = "yes" ]; then
-    SSL_ENABLED="on"
-    if grep -q "TP_PORT" .env; then
-       sed -i "s|TP_PORT=.*|TP_PORT=443|" .env
-    fi
+   SSL_ENABLED="on"
+   if grep -q "^TP_PORT=" .env; then
+      sed -i "s/^TP_PORT=.*/TP_PORT=443/" .env
+   else
+      echo "TP_PORT=443" >> .env
+   fi
 else
-    SSL_ENABLED="off"
-    if grep -q "TP_PORT" .env; then
-        sed -i "s|TP_PORT=.*|TP_PORT=80|" .env
-    fi
+   SSL_ENABLED="off"
+   if grep -q "^TP_PORT=" .env; then
+       sed -i "s/^TP_PORT=.*/TP_PORT=80/" .env
+   else
+       echo "TP_PORT=80" >> .env
+   fi
 fi
 
-if grep -q "SSL_ENABLED" .env; then
-    sed -i "s|SSL_ENABLED=.*|SSL_ENABLED=$SSL_ENABLED|" .env
-    echo "✅ Updated SSL_ENABLED to $SSL_ENABLED"
+if grep -q "^SSL_ENABLED=" .env; then
+   sed -i "s/^SSL_ENABLED=.*/SSL_ENABLED=$SSL_ENABLED/" .env
+   echo "✅ Updated SSL_ENABLED to $SSL_ENABLED"
 else
-    echo "" >> .env
-    echo "# Docker-specific configuration" >> .env
-    echo "SSL_ENABLED=$SSL_ENABLED" >> .env
-    echo "✅ Added Docker SSL configuration (SSL_ENABLED=$SSL_ENABLED)"
+   echo "" >> .env
+   echo "# Docker-specific configuration" >> .env
+   echo "SSL_ENABLED=$SSL_ENABLED" >> .env
+   echo "✅ Added Docker SSL configuration (SSL_ENABLED=$SSL_ENABLED)"
 fi
 
 echo ""
@@ -111,8 +123,8 @@ echo ""
 echo "📋 Next steps:"
 echo "   1. Run: docker-compose up"
 if [ "$SSL_ENABLED" = "on" ]; then
-    echo "   2. Open: https://$TP_HOST"
+   echo "   2. Open: https://$TP_HOST"
 else
-    echo "   2. Open: http://$TP_HOST"
+   echo "   2. Open: http://$TP_HOST"
 fi
 echo ""