I'm guessing that they aren't using "honor-system SQL Injection protection", but they are hard-blocking all of that in the UI layer, which is not a terrible thi

I'm guessing that they aren't using "honor-system SQL Injection protection", but they are hard-blocking all of that in the UI layer, which is not a terrible thing to do, but not the most sophisticated and user-friendly approach. After they got a handful of calls about it, they had to put it in their FAQ. Sorry, I just killed the joke.