be clear about input sanitization