diff --git a/api.php b/api.php
index 6d11b8d..8fafd7e 100755
--- a/api.php
+++ b/api.php
@@ -164,6 +164,7 @@ if ($q == "getAddress") {
      */
 
     $account = $data['account'];
+    $public_key = san($data['public_key'] ?? '');
     if (!empty($public_key) && strlen($public_key) < 32) {
         api_err("Invalid public key");
     }