Filter XML vars, we don't trust data from others.
Also test the get_suggested_action() function, value should be null.