You're right. That's why I said upfront - whitelist values in the userquery object.