match query args against regular expressions to protect against bad user input