Also, don't make the easy mistake of thinking the values from radio buttons and checkboxes are 'safe' — they can be set to any value just like any other GET or POST parameter.