sure, why should they escape user input when they can just ban various attempts as they notice them occurring...