Better sanitize values

https://hackerone.com/reports/24185
Ah, yes. how should we do? return blank stdClass?