sanitized incorrectly sanitized empty string