Better sanitize values

https://hackerone.com/reports/24185
Not sure :P probably initialize those fields with null values outside of the if then return it regardless.