> 2. They do not try to detect bad data (the way they certainly try to detect bad code) It was actually the sanitization function regex that became unresponsiv

> 2. They do not try to detect bad data (the way they certainly try to detect bad code) It was actually the sanitization function regex that became unresponsive. So they killed the page by trying to stop bad data coming in. Agreed on your other points though.