you could sanitize `$id` to reduce unnecessary db requests (or maybe add a note to do so when used in production code)