I would consider "user input" to be everything coming back from the client, that includes everything down to cookies, HTTP-Headers, form values. Validate every

I would consider "user input" to be everything coming back from the client, that includes everything down to cookies, HTTP-Headers, form values. Validate everything. Re-check authorisation always. My favourite too was being new into a development job and buying our biggest package for a penny. What I hadn't counted on was that this was a fairly new system and the CEO was still copied in to every buy order. Thankfully the company took it in good spirit, I was even sent an expenses form to reclaim the penny! :)