WordPress has plenty of functions to sanitize, the one who made the theme or dropped in the form probably overlooked it.