Any data that comes from outside the script should be considered tainted data. This includes user-input, database-results, file-system data or anything else that is not written down by the programmer hem-/herself.

-- EricBouwers - 29 Dec 2006