some PHP sanitization

Signed-off-by: Chris “Kwpolska” Warrick <kwpolska@gmail.com>