It is recommended that untrusted input is never processed as
server-side code.

To validate input, the application should ensure
that the supplied value contains only the data that are required to
perform the relevant action.

For example, where a username is
required, then no non-alpha characters should not be accepted.