need to sanitize $_REQUEST
https://github.com/concrete5/concrete5/blob/master/web/concrete/core/helpers/security.php#L19-L21