TL;DR : Don't naively use user input (AKA validate user input)

(well.. duh! :)