better user data validation, avoid floats client-side