We should be sanitizing every user input. Let me see what else I can break!