https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_error_handling https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_er... > Many of the first UT

https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_error_handling https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_er... > Many of the first UTF-8 decoders would decode these, ignoring incorrect bits and accepting overlong results. Carefully crafted invalid UTF-8 could make them either skip or create ASCII characters such as NUL, slash, or quotes. Invalid UTF-8 has been used to bypass security validations in high-profile products including Microsoft's IIS web server[26] and Apache's Tomcat servlet container.[27] RFC 3629 states "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."