Comment by lysace

This is a worthwhile read. Don't trust user input and try your damnest not to feed it into third party components. If you do, keep them up to date.