new interpreter argument:

    -X int_max_str_digits=number
       limit the size of int<->str conversions.
       This helps avoid denial of service attacks when parsing untrusted data.
       The default is sys.int_info.default_max_str_digits.  0 disables.

this should not be a runtime configuration setting, fix the sodding algorithm to not be quadratic

will we be getting PHP style magic quotes soon? that also protects developers against untrusted input (bonus! this could be configured too!)

or an inability to pass strings into the regular expression module? that can also cause DoS

(what happened to Python?)