A comment box, a sign-up form, a search field: every value a visitor sends is just text that they chose. Safe PHP validates input on the way in and escapes it on the way out.