OK. This'll be fine. My initial concern was that I thought it was using the product names in the string, which--while only input by facility admins--would theoretically be vulnerable to XSS.