Don't use urldecode/utf8_encode when sanitizing parameters. Closes #1715, #1717