Restrict card_id characters.

README.md

@@ -895,7 +895,7 @@ type: custom:frigate-card
 
 | Option | Default | Overridable | Description |
 | - | - | - | - |
-| `card_id` | | :heavy_multiplication_x: | **Advanced users only**: An optional ID to uniquely identify this card. For use when actions are being sent to card(s) via the [query string](#query-string-actions).|
+| `card_id` | | :heavy_multiplication_x: | **Advanced users only**: An optional ID to uniquely identify this card. For use when actions are being sent to card(s) via the [query string](#query-string-actions). Must exclusively consist of these characters: `[a-zA-Z0-9_]`.|
 
 <a name="webrtc"></a>
 

src/types.ts

@@ -1319,8 +1319,12 @@ export const frigateCardConfigSchema = z.object({
   // Support for card_mod (https://github.com/thomasloven/lovelace-card-mod).
   card_mod: z.unknown(),
 
-  // Card ID (used for query string commands).
-  card_id: z.string().optional(),
+  // Card ID (used for query string commands). Restrict contents to only values
+  // that be easily used in a URL.
+  card_id: z
+    .string()
+    .regex(/^\w+$/)
+    .optional(),
 
   // Stock lovelace card config.
   type: z.string(),