Anything which gets its data from outside the program, whether it's in the environment, on the command line, or through system calls needs to be cleaned before it's used to make a system call.