Code can be injected anywhere. You'd have to add checks to every single function.