protect BO titles from injection