better security at reading the get params for export excel file