Sanitization by validate, not by filter