diff --git a/lib/ui/api.ts b/lib/ui/api.ts
index 2a02937..fb00a88 100644
--- a/lib/ui/api.ts
+++ b/lib/ui/api.ts
@@ -483,7 +483,14 @@ router.post("/devices/:id/tags", async (ctx, next) => {
     return void (ctx.status = 403);
   }
 
-  await db.updateDeviceTags(ctx.params.id, ctx.request.body);
+  try {
+    await db.updateDeviceTags(ctx.params.id, ctx.request.body);
+  } catch (error) {
+    log.message += " failed";
+    logger.accessWarn(log);
+    ctx.body = error.message;
+    return void (ctx.status = 400);
+  }
 
   logger.accessInfo(log);
 
diff --git a/lib/ui/db.ts b/lib/ui/db.ts
index b4ea264..401cfdc 100644
--- a/lib/ui/db.ts
+++ b/lib/ui/db.ts
@@ -211,9 +211,16 @@ export function updateDeviceTags(deviceId, tags): Promise<void> {
     const add = [];
     const pull = [];
 
-    for (const [tag, onOff] of Object.entries(tags)) {
-      if (onOff) add.push(tag);
-      else pull.push(tag);
+    const regex = /^[0-9a-zA-Z_]+$/;
+    for (let [tag, onOff] of Object.entries(tags)) {
+      tag = tag.trim();
+      if (onOff) {
+        if (!tag.match(regex))
+          return void reject(new Error(`Invalid tag '${tag}'`));
+        add.push(tag);
+      } else {
+        pull.push(tag);
+      }
     }
     getClient()
       .then(client => {