User: input is sanitized in user.php db entry functions instead of post handlers