fix security flaw where untrusted input wasn't being sanitized