Better sanitize values

https://hackerone.com/reports/24185
@KorvinSzanto I only added this line.