Don't assume the string is valid UTF-8, since it may be user data.