I know these libs are primarily for devs to localize their apps but can they be used also with untrusted inputs, both message strings and vars?