The first rule of designing a public interface to an application is to assume the worst about any user data. Failure to do so leads to stuff like this.