> Not trusting user input is a good start, but the client shouldn't be trusted, either.

That's in there:

"Validation must occur on the receiving side of communications. Validation on the sending side is a user experience decision."