sanitize AJAX queries