Comment 2 for bug 698305

This is a particular case of bug 243422 ("Loggerhead doesn't validate user input"), but I won't mark it as a duplicate as fixing particular cases will be easier than doing a codebase-wide audit. Speaking of which, patches welcome :-)