Escaping user input and rewriting URLs