By the way, there is no "user-supplied data". 
It would be very different if it did something like this:

```
  html += 'value="%s" ' % request.GET.get(key)
```

However, this does raise a concern. If the default on a model in models.py is something like:

```
    defaults = {
    }
```