sanitie req.query too