That's what i'm saying. You shouldn't trust any data from sources like cookies, query strings and even http headers. If you blindly trust them, this is not a problem of programming language. You should sanitize data before using it.