For necessary performance reasons, a lot of code does not ensure that its input is valid UTF-8, and simply leaves that burden to the programmer. Strings are oft

For necessary performance reasons, a lot of code does not ensure that its input is valid UTF-8, and simply leaves that burden to the programmer. Strings are often passed through many, many layers of various types of processing, and it would slow code down significantly if each step in this process needed to validate the entire string all over again, so it's typical to expect that the string is validated once at the beginning, and then passed through various routines that each blindly assume their input is valid UTF-8 and guarantee to return valid UTF-8 as well if that assumption is true. If you skip this initial validation, you open yourself to security problems caused by differences in the undefined behavior of these various routines that are assuming valid input. As an example, imagine if your code for escaping HTML saw an invalid byte sequence immediately before a "<" and failed to escape it because of that, but then the HTML parser you pass the result to treats the invalid byte sequence differently and successfully sees and parses the "<" that should have been escaped.