The exception to the principle of "one tainted value taints the whole expression" is with the ternary conditional operator "?:". Since code with a ternary conditional $result = $tainted_value ? "Untainted" : "Also untainted"; is effectively if ( $tainted_value ) { $result = "Untainted"; } else { $result = "Also untainted"; } it doesn't make sense for $result to be tainted.