> Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not. Still, I think it's a good way to think. Expect th

> Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not. Still, I think it's a good way to think. Expect that there's a way for that input to do something malicious, even if it doesn't seem immediately possible. I have a dynamic DNS daemon that fetches my IP via HTTP GET, and the first thing I do is validate that it's actually an IP before I do anything else with it.