This really doesn't sound like a problem with the update function, this just sounds like web applications 101 - don't trust user data.