Better sanitize values

https://hackerone.com/reports/24185
Are we sure that this isn't used?