The example I gave in the blog post was a real-world example: a link to a user's profile page that includes the username in the URL. This is extremely common.

The example I gave in the blog post was a real-world example: a link to a user's profile page that includes the username in the URL. This is extremely common. Naturally, only a fool would allow usernames to contain unsafe characters, but there are a lot of fools writing web apps.