Directly doing anything with attacker supplied data is generally a no-no. Everything that may come from a user must be filtered, escaped or generally treated a

Directly doing anything with attacker supplied data is generally a no-no. Everything that may come from a user must be filtered, escaped or generally treated as hostile. As an example on an IRC channel someone once made their chan bot log the channel to the web, all it took was pasting javascript into an IRC window, and typing "LOL look at this! http://stupidbot.com/ircweblog" http://stupidbot.com/ircweblog". Channel pwned.