Using filter_var to be extra paranoid about XSS