Besides id strings, the content objects have Unique Identifiers, or UID, which do not change even if the object is moved or renamed. After finding Upton incredibly drunk, you need to protect him. Ideally remove everything but the known good data and filter meta characters from the user input. This is only for publishing methods for HTTP requests. __bobo_traverse__() which is an archaic method from the early 2000s. Warning Zope traversal is a minefield.