I remember a security test I did. One parameter had to be float value, and validated it by casting it as float. NaN and Infinity are valid float values in many languages. The application did not like that