nit: we actually only sanitize one attr at a time, so there probably shouldn't be a s. No need to fix up this or the callers.