[peterwwillis]

Database output is application input. All forms of input need to be sanitized, period.