You should determine what is legal and reject anything that does not match that definition. These tests should usually be centralized in one place so that the validity tests can be easily examined for correctness later. While parsing user input, it's a good idea to temporarily drop all privileges. See the section below on minimizing permissions. Not all inputs are under the control of an untrusted user, so you need only worry about those inputs that are.
Many programs use the command line as an input interface, accepting input by being passed arguments.
By default, environment variables are inherited from a process' parent. However, when a program executes another program, the calling program can set the environment variables to arbitrary values. Some environment variables are dangerous because many libraries and programs are controlled by environment variables in ways that are obscure, subtle, or undocumented. For example, the IFS variable is used by the sh and bash shell to determine which characters separate command line arguments. What is worse is that not all environment variables are documented, and even if they are, those other programs may change and add dangerous environment variables.