use sanitised type, not one from params