determining which inputs are so malformed that they should be rejected outright.
When dynamically constructing web pages, use stringent whitelists that limit the
character set based on the expected value of the parameter in the request. All input
should be validated and cleansed, not just parameters that the user is supposed to specify,