Prevent possible SQL injection issue

Not really a problem because the input values are (currently)
always validated against the really available options.