Those are pretty clearly delineated as user-generated content, and also aren't able to be modified to include information that the malicious user doesn't have another way of accessing.