Unfortunatly this also mean : "any SQL injection  `strtotime()` does not recognize should be passed through untouched". Looks like a  introduced security hole.