lol forgot to sanitize the GET input

Signed-off-by: Difegue <sugoi@cock.li>