I thought that was the first rule of rendering web content? Or was it protocol parsers?

I remember, it was first rule of video game character creation screens:

Second rule of SQL: Never trust user input. Third rule of SQL: Never trust user input.