Better sanitize values

https://hackerone.com/reports/24185
:point_up_2: How about this return value? I'd like to resend PR