jurgenhaas/tagadelic — comment on commit 739c096900e8658fe722acff747fbe7b0210d65c
File: tagadelic.module line 240
By berkes:

Makes sense.

But would $key not need escaping? I cannot see where it comes from exactly with all the hooks involved. On a normal clean install it would come directly from the taxonomy_term_reference field table, but any sort of module can be inbetween: hence this can be considered an untrusted source. not?