@xocolatl @emacsen Yeah, input from a user, where there's been a constant stream of code injections for decades basically whenever an ORM isn't used and the data in question isn't simple to validate (like free-form text for example).