There's one place only place in the code I can see where $articleId is coming in externally (via url).  Its via the fetch() call, and it is protected at about line 550 by 
		/* DEALING WITH A PARTICULAR ARTICLE HERE */
		$articleId = intval($param_1);
I'm fine with checking/protecting it elsewhere, but I believe all its other values are being set internally via OJS methods. (fixed &$article btw).