sanitize query params