title: Do hidden input fields have to be escaped in ColdFusion?
body: <p>Using ColdFusion 8 I usually escape all my form inputs like so:</p>
  
  <pre><code>&lt;input id="foo" value="#XMLFormat(trim( form_name.param_name ))#" /&gt;
  </code></pre>
  
  <p>So how about hidden inputs? Should these also be escaped? I haven't tried, but I could very well pull a hidden input up in Firebug, enter whatever and try to submit, can I?</p>