if I had a dollar for every time I had forgotten to escape something properly (regex, html, sql, strings, you name it) I'd buy a new car.