sanitize input url