improperly handling user data