Use a form object here and set the fields to non-required integers. This will protect against some form injection.