I think replacing all that with a call to `sanitize_title_with_dashes( $data['suffix' )` would be both cleaner and more secure.