validate and sanitize