It's a data sanitation issue.  Since it comes from an outside source (the $response array), you should consider it tainted until you know otherwise.