added sanitize params call in controller