But could be arbitrary user input via a POST..