diff --git a/sanitiser/_layers.js b/sanitiser/_layers.js
new file mode 100644
index 00000000..b7922557
--- /dev/null
+++ b/sanitiser/_layers.js
@@ -0,0 +1,46 @@
+
+var check = require('check-types'),
+    types = require('../query/types'),
+    get_layers = require('../helper/layers');
+
+// decide which layers can be queried
+var ALIAS_LAYERS  = ['poi', 'admin', 'address'],
+    ALIAS_TYPES = types.concat(ALIAS_LAYERS),
+    ALIAS_TYPES_JOINED = ALIAS_TYPES.join(',');
+
+// validate inputs, convert types and apply defaults
+function sanitize( raw, clean ){
+
+  // error & warning messages
+  var messages = { errors: [], warnings: [] };
+
+  // init clean.types
+  clean.types = clean.types || {};
+
+  // default case (no layers specified in GET params)
+  // don't even set the from_layers key in this case
+  if( check.unemptyString( raw.layers ) ){
+
+    // parse GET params
+    var layers = raw.layers.split(',').map( function( layer ){
+      return layer.toLowerCase(); // lowercase inputs
+    });
+
+    // validate layer names
+    for( var x=0; x<layers.length; x++ ){
+      if( -1 === ALIAS_TYPES.indexOf( layers[x] ) ){
+        messages.errors.push('invalid param \'layers\': must be one or more of ' + ALIAS_TYPES_JOINED);
+      }
+    }
+
+    // set 'from_layers' param
+    if( !messages.errors.length ){
+      clean.types.from_layers = get_layers(layers);
+    }
+  }
+
+  return messages;
+}
+
+// export function
+module.exports = sanitize;
diff --git a/sanitiser/_source.js b/sanitiser/_source.js
new file mode 100644
index 00000000..88d620fc
--- /dev/null
+++ b/sanitiser/_source.js
@@ -0,0 +1,45 @@
+
+var check = require('check-types'),
+    sources_map = require( '../query/sources' );
+
+var ALL_SOURCES = Object.keys(sources_map),
+    ALL_SOURCES_JOINED = ALL_SOURCES.join(',');
+
+function sanitize( raw, clean ) {
+
+  // error & warning messages
+  var messages = { errors: [], warnings: [] };
+
+  // init clean.types (if not already init)
+  clean.types = clean.types || {};
+
+  // default case (no layers specified in GET params)
+  // don't even set the from_layers key in this case
+  if( check.unemptyString( raw.source ) ){
+
+    var sources = raw.source.split(',');
+
+    var invalid_sources = sources.filter(function(source) {
+      return ALL_SOURCES.indexOf(source) === -1;
+    });
+
+    if( invalid_sources.length > 0 ){
+      invalid_sources.forEach( function( invalid ){
+        messages.errors.push('\'' + invalid + '\' is an invalid source parameter. Valid options: ' + ALL_SOURCES_JOINED);
+      });
+    }
+
+    else {
+      var types = sources.reduce(function(acc, source) {
+        return acc.concat(sources_map[source]);
+      }, []);
+
+      clean.types.from_source = types;
+    }
+
+  }
+
+  return messages;
+}
+
+module.exports = sanitize;
diff --git a/test/unit/sanitiser/_source.js b/test/unit/sanitiser/_source.js
new file mode 100644
index 00000000..991accd5
--- /dev/null
+++ b/test/unit/sanitiser/_source.js
@@ -0,0 +1,127 @@
+var sanitize = require( '../../../sanitiser/_source' );
+
+var success_response = { error: false };
+
+module.exports.tests = {};
+
+module.exports.tests.no_sources = function(test, common) {
+  test('source is not set', function(t) {
+    var req = {
+      query: { },
+      clean: { }
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(req.clean.types, {}, 'clean.types should be empty object');
+    t.deepEqual(response.errors, [], 'no error returned');
+    t.deepEqual(response.warnings, [], 'no warnings returned');
+    t.end();
+  });
+
+  test('source is empty string', function(t) {
+    var req = {
+      query: {
+        source: ''
+      },
+      clean: { }
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(req.clean.types, {}, 'clean.types should be empty object');
+    t.deepEqual(response.errors, [], 'no error returned');
+    t.deepEqual(response.warnings, [], 'no warnings returned');
+    t.end();
+  });
+};
+
+module.exports.tests.valid_sources = function(test, common) {
+  test('geonames source', function(t) {
+    var req = {
+      query: {
+        source: 'geonames'
+      },
+      clean: { }
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(req.clean.types, { from_source: ['geoname'] }, 'clean.types should contain from_source entry with geonames');
+    t.deepEqual(response.errors, [], 'no error returned');
+    t.deepEqual(response.warnings, [], 'no warnings returned');
+    t.end();
+  });
+
+  test('openstreetmap source', function(t) {
+    var req = {
+      query: {
+        source: 'openstreetmap'
+      },
+      clean: { }
+    };
+    var expected_types = {
+      from_source: ['osmaddress', 'osmnode', 'osmway']
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(req.clean.types, expected_types, 'clean.types should contain from_source entry with multiple entries for openstreetmap');
+    t.deepEqual(response.errors, [], 'no error returned');
+    t.deepEqual(response.warnings, [], 'no warnings returned');
+    t.end();
+  });
+
+  test('multiple sources', function(t) {
+    var req = {
+      query: {
+        source: 'openstreetmap,openaddresses'
+      },
+      clean: { }
+    };
+    var expected_types = {
+      from_source: ['osmaddress', 'osmnode', 'osmway', 'openaddresses']
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(req.clean.types, expected_types,
+                'clean.types should contain from_source entry with multiple entries for openstreetmap and openadresses');
+    t.deepEqual(response.errors, [], 'no error returned');
+    t.deepEqual(response.warnings, [], 'no warnings returned');
+    t.end();
+  });
+};
+
+module.exports.tests.invalid_sources = function(test, common) {
+  test('geonames source', function(t) {
+    var req = {
+      query: {
+        source: 'notasource'
+      },
+      clean: { }
+    };
+    var expected_response = {
+      errors: [
+        '\'notasource\' is an invalid source parameter. Valid options: geonames,openaddresses,quattroshapes,openstreetmap'
+      ],
+      warnings: []
+    };
+
+    var response = sanitize(req.query, req.clean);
+
+    t.deepEqual(response, expected_response, 'error with message returned');
+    t.deepEqual(req.clean.types, { }, 'clean.types should remain empty');
+    t.end();
+  });
+};
+
+module.exports.all = function (tape, common) {
+  function test(name, testFunction) {
+    return tape('SANTIZE _source ' + name, testFunction);
+  }
+
+  for( var testCase in module.exports.tests ){
+    module.exports.tests[testCase](test, common);
+  }
+};