In light of the continuing vulnerability to long user input, I humbly offer the following aphorism, suitable for display on all Netscape programmer cubicles: Copy strings with strdup, not strcpy.