I'm surprised this ever made it into production. Never, ever trust user input.