really basic sanitse on client side