From a programming perspective, it's normally best to consider the user a malicious idiot. If you remember this, you always know to validate your data for any sort of incorrect input and then filter it.

The first because he's an idiot.
The second because he's malicious.

__________________
My Blog