OK this time no evil chars or javascript for you! Only numbers and + - * / allowed. Can you bypass my checks and still steal the cookie?