You forgot about one of the most important rules: "never trust user input".