That's a little over the top. string.lower() is not a security vulnerability. Not following the spec is the security vulnerability.