user: add input sanitization