All parameters should be validated. Even if it is only a free form field, at least length should be checked. This includes all cookies, hidden fields, form fields, query string parameters, and any headers used by application.