When I test this in an editbox, the entire /var line gets sent to the server.
This is due to the way /var was originally implemented, as a way of setting local variables in a script. /var is not actually a command in the same way as other commands. It is parsed inline, inbetween other script parser processes, and converted to /set internally. This means that if I did change it to be a normal command, its code would be moved outside of its current parsing sequence, which would likely lead to backwards-compatibility issues.
To prevent /var being sent to the server, I will add a second check for /var as a normal command which will report an error.
