It is very important for you to understand that ANY input from the users has to be sanitized in one way or another, or you are potentialy opening up for security holes.
Any input could mean dropdown boxes or other data you would think is static. Examples of this is simply anything returned from the user like for example:
- Radio buttons
- Dropdown boxes
- Data coming from plugins like flash, silverlight and so on.
- Simply anything that is sent to the client!
To better illustrate this I encourage you to download a simple proxy which will enable you to show all the data being sent to your server when submit a form. An example POST request is shown here:
POST /api/rest HTTP/1.1
User-agent: Googlebot/2.1 (+http://www.google.com/bot.html)
Anything that you have to rely on in your business logic coming from the client side has to be cleaned.
Remember that this goes for anything coming from the client side. IT CANNOT BE TRUSTED! ... Even if it is simply a string being returned to the client (e.g. a username) it should be cleaned so that it is not vulnerable for cross site scripting and other attack vectors.
Edit: As @Avid pointed out in the comments it is also imperative to know that data passed through cookies is also sent from the client side, making them vulnerable to tampering. This also applies for any other field in the headers (or anything coming from the client) like the user-agent or referrer field to name a few.
In the example above the HTTP request may foil some security systems if they rely on the referrer field to for example authorize the user. The example also makes it appear that it is the Google bot which may in some circumstances provide different content on the page you are requesting (source).