I guess that's why you shouldn't be _validating_ things, and then praying them on as-is. "Parsing is validation" is (also) the idea that after validation, your data is in a format that reflects and enforces what's known about it.

"Safe strings" is an example of that idea. Not always possible or practical, but always worth considering if you're doing "validation" as a function.