Add a bounds check before accessing a user-provided PK string