diff --git a/src/usr/local/www/services_dhcp.php b/src/usr/local/www/services_dhcp.php
index b0e6e1f258..9b1a201198 100644
--- a/src/usr/local/www/services_dhcp.php
+++ b/src/usr/local/www/services_dhcp.php
@@ -47,6 +47,12 @@ $dnsregpolicy_values = [
 	'disable' => gettext('Disable')
 ];
 
+$customitemtypes = array(
+	'text' => gettext('Text'), 'string' => gettext('String'), 'boolean' => gettext('Boolean'),
+	'unsigned integer 8' => gettext('Unsigned 8-bit integer'), 'unsigned integer 16' => gettext('Unsigned 16-bit integer'), 'unsigned integer 32' => gettext('Unsigned 32-bit integer'),
+	'signed integer 8' => gettext('Signed 8-bit integer'), 'signed integer 16' => gettext('Signed 16-bit integer'), 'signed integer 32' => gettext('Signed 32-bit integer'), 'ip-address' => gettext('IP address or host')
+);
+
 if (!g_get('services_dhcp_server_enable')) {
 	header("Location: /");
 	exit;
@@ -502,6 +508,9 @@ if ($if && isset($_POST['save'])) {
 
 	if (is_array($pconfig['numberoptions']['item'])) {
 		foreach ($pconfig['numberoptions']['item'] as $numberoption) {
+			if (!array_key_exists($numberoption['type'], $customitemtypes)) {
+				$input_errors[] = gettext("Invalid custom option type.");
+			}
 			$numberoption_value = base64_decode($numberoption['value']);
 			if ($numberoption['type'] == 'text' && strstr($numberoption_value, '"')) {
 				$input_errors[] = gettext("Text type cannot include quotation marks.");
@@ -1790,12 +1799,6 @@ if (!$pconfig['numberoptions']) {
 	$pconfig['numberoptions']['item']  = array(array('number' => '', 'type' => 'text', 'value' => ''));
 }
 
-$customitemtypes = array(
-	'text' => gettext('Text'), 'string' => gettext('String'), 'boolean' => gettext('Boolean'),
-	'unsigned integer 8' => gettext('Unsigned 8-bit integer'), 'unsigned integer 16' => gettext('Unsigned 16-bit integer'), 'unsigned integer 32' => gettext('Unsigned 32-bit integer'),
-	'signed integer 8' => gettext('Signed 8-bit integer'), 'signed integer 16' => gettext('Signed 16-bit integer'), 'signed integer 32' => gettext('Signed 32-bit integer'), 'ip-address' => gettext('IP address or host')
-);
-
 $numrows = count($item) -1;
 $counter = 0;
 
diff --git a/src/usr/local/www/services_dhcp_edit.php b/src/usr/local/www/services_dhcp_edit.php
index c50d9def71..902d989808 100644
--- a/src/usr/local/www/services_dhcp_edit.php
+++ b/src/usr/local/www/services_dhcp_edit.php
@@ -40,6 +40,12 @@ $dnsregpolicy_values = [
 	'disable' => gettext('Disable')
 ];
 
+$customitemtypes = array(
+	'text' => gettext('Text'), 'string' => gettext('String'), 'boolean' => gettext('Boolean'),
+	'unsigned integer 8' => gettext('Unsigned 8-bit integer'), 'unsigned integer 16' => gettext('Unsigned 16-bit integer'), 'unsigned integer 32' => gettext('Unsigned 32-bit integer'),
+	'signed integer 8' => gettext('Signed 8-bit integer'), 'signed integer 16' => gettext('Signed 16-bit integer'), 'signed integer 32' => gettext('Signed 32-bit integer'), 'ip-address' => gettext('IP address or host')
+);
+
 function staticmapcmp($a, $b) {
 	return ipcmp($a['ipaddr'], $b['ipaddr']);
 }
@@ -387,6 +393,9 @@ if ($_POST['save']) {
 	/* Redmine #13584 */
 	if (is_array($pconfig['numberoptions']['item'])) {
 		foreach ($pconfig['numberoptions']['item'] as $numberoption) {
+			if (!array_key_exists($numberoption['type'], $customitemtypes)) {
+				$input_errors[] = gettext("Invalid custom option type.");
+			}
 			$numberoption_value = base64_decode($numberoption['value']);
 			if ($numberoption['type'] == 'text' && strstr($numberoption_value, '"')) {
 				$input_errors[] = gettext("Text type cannot include quotation marks.");
@@ -1039,12 +1048,6 @@ if (!$pconfig['numberoptions']) {
 	$pconfig['numberoptions']['item']  = array(array('number' => '', 'type' => 'text', 'value' => ''));
 }
 
-$customitemtypes = array(
-	'text' => gettext('Text'), 'string' => gettext('String'), 'boolean' => gettext('Boolean'),
-	'unsigned integer 8' => gettext('Unsigned 8-bit integer'), 'unsigned integer 16' => gettext('Unsigned 16-bit integer'), 'unsigned integer 32' => gettext('Unsigned 32-bit integer'),
-	'signed integer 8' => gettext('Signed 8-bit integer'), 'signed integer 16' => gettext('Signed 16-bit integer'), 'signed integer 32' => gettext('Signed 32-bit integer'), 'ip-address' => gettext('IP address or host')
-);
-
 $numrows = count($item) -1;
 $counter = 0;
 
@@ -1353,7 +1356,7 @@ events.push(function() {
 			text = "<?=gettext('Display Advanced');?>";
 		}
 		var children = $('#btnadvnwkboot').children();
-		$('#btnadvnwkboot').text(text).prepend(children);	
+		$('#btnadvnwkboot').text(text).prepend(children);
 	}
 
 	$('#btnadvnwkboot').click(function(event) {