So you're saying you haven't tracked down where the tainted value is coming from?
If you do that, and its not coming from a core module, you don't have to modify any core module :)
so it pays to do it.
MJDsays "you can't just make shit up and expect the computer to know what you mean, retardo!"