[tptacek]

You see how we're converging on "just use proper input validation", which is the all-time least useful piece of advice in software security?

[Dylan16807]

Because input validation is hard to do. A rule to not pass input EVER (outside of parameters), even in a supposedly validated form, is something different.