It isn't really so much about data being "taintable", but rather about the fact that not all strings are really the same "type". In this case, the field was pro

It isn't really so much about data being "taintable", but rather about the fact that not all strings are really the same "type". In this case, the field was probably meant to be "plain text", but it was inserted into HTML without any conversion. Even data that doesn't come from a user (ie: that is not "tainted") needs to be converted to the correct type.