Please sanitize `$_['categories']` as this is an user provided value.