prevent mongodb injection (newbie grade)