P.S.  I'm still playing around with things to see what I can break, but in general you should assume that anything coming from param could have been modified.  This may help you track down stuff I cant see.