The rule I&#x27;ve developed for myself is never <i>clean up</i> data for security purposes. There are some cases where it is valid to examine the data for validity; for instance, there&#x27;s many places where you&#x27;d like to filter null characters or &quot;all of the ASCII control characters except the whitespace&quot;, and it&#x27;s valid to look for those things. But if you find them, <i>reject</i> the input. In theory you&#x27;d think you can clean it up, but in practice it turns out to be just too dangerous. Too many concrete instances of real-world failure, and reality always trumps theory.