theres more than just python you know. you have to take care of this regardless of the engine behind. beside, even parametrized, you have to be careful. I'll r

theres more than just python you know. you have to take care of this regardless of the engine behind. beside, even parametrized, you have to be careful. I'll remind you of the 2004 Safari handler exploit. Apple fixed the first exploit by using parametrized argument list. Woot. Next day, exploited again because some programs call execve on their argument list, for example ssh -o'ProxyCommand=exploit here' which is 2 arguments (-o and the complete proxycommand line including the exploit line). This is valid for websites as well.