secure $_POST["from"] and $_POST["to"] with intval