validate id format

fixes injection