I feel like my job is to never trust anyone. Don't trust their string encodings, the characters they put into those strings, the arrangements of the characters we do allow, etc.