Avoid XSS
- $modx->htmlspecialchars or explicit integer casting on $_GET/$_POST values