I believe this. We've recently been tracking down bugs coming from users of a web site a friend and I run. We couldn't figure out what was going on until we realized that some injected code was stomping on our site's code and breaking everything. Grrr. So now we have to decide if we want to change all our code to be way more defensive (or offensive) so that we work in the face of hostile injected code. Or perhaps we just live with 5% of our users not working.