untrusted input
Any data that comes from outside your program and could have been written by an attacker.
Untrusted input is data crossing a trust boundary (requests, files, headers, environment); it must be validated, encoded or parameterized before use.
Examples
Form fields, query strings, uploaded files, HTTP headers, and data from another team's API.