$columns is an array that I have defined in the controller to store the list of summarizable columns in one place so its not exactly user entered but using htmlspecialchars() wouldnt hurt