Thank you for mentioning this. What I don't understand is that no one is talking about the responsibility of the programs reading the user input. They have a re

Thank you for mentioning this. What I don't understand is that no one is talking about the responsibility of the programs reading the user input. They have a responsibility to validate anything they receive using a whitelisting approach (i.e. denying anything that doesn't match expected patterns). If a program simply slurps in user input without doing any basic validation according to published RFCs then there's a bug in that program.