It's not a database sanitization issue. The problem is that for cars that don't have a plate or the plate wasn't entered for whatever reason, in some cases people were entering "NULL" (the string). That then ended up matching his plate.