. . . . "You should always check all user input before passing it onto another process or method call which may use an external resource such as the file system or a database." .