guys, is it good or bad for security if the computer program treats code and user input as the same thing? asking for a friend