although I do not see obvious injection possibility it is better to be more precise and try to make regular expression more rigid, e.g. we try to anchor it at the end -- please see other filters for inspiration ;)