The $name is a name from a database and it is checked before it gets to the database, I am filtering for any strange character. It should be safe.