> Not trusting user input is a good start, but the client shouldn't be trusted, either. That's in there: "Validation must occur on the receiving side of commu

> Not trusting user input is a good start, but the client shouldn't be trusted, either. That's in there: "Validation must occur on the receiving side of communications. Validation on the sending side is a user experience decision."