$control_param would best be sanitized to only allow valid '*Iconic' options, otherwise the value of any config option could be used