$untrusted_format = "%10000000d";
sprintf( $untrusted_format, 1 );