I'm not quite sure about this. There are some methods available for escaping potentially malicous code. I'd say rather use such a method or don't sanitize at all. Right now, we're just making sure that it has 2 characters. That's not enough to improve security, but at the same time it's too much for normal entries. I mean, of course, it filters _some_ bogus entries like `foo`, but it still allows stuff like `xx`.