Earlier quoted context omitted.
Whats interesting is just the idea that you should sanitize ALL inputs, no matter how unlikely it is that the input could be malicious.
I remember that perl has (had?) a feature where all variables would be "tainted". Using a tainted variable would make the program exit in an error and the only way to clean them is to pass them through a regex.
Strings are never universally tainted. They're tainted for a specific purpose. One language will treat backticks as a string quote, another as a subshell substitution. One will think $ is ok, another will interpolate the string. But in most cases I've seen, tainted flag is just used for "Ah, we quoted the ' in the string - you're safe now" :-(