Validate HDF5_* before eval to prevent command injection

[ptim0626]

HDF5_ROOT, HDF5_HOME and HDF5_DIR should be validated before eval, as users could potentially set those env vars to something malicious.

Other places should also be checked.