$status is not enforced to be a number, therefore could also contain "\r\n" and finally used for a injection