How about putting the quotes around a value in JavaScript to prevent a DB error when the server concatenates it into a SQL statement later? There was even a he

How about putting the quotes around a value in JavaScript to prevent a DB error when the server concatenates it into a SQL statement later? There was even a helpful comment in the page source to explaining what was happening. I sent an email but it wasn't answered. I found this on a mapping site (now defunct) that let you printout sections of maps for a change. However, you could get small sample maps for free. And so by altering the width and height parameters in the page source ... This wasn't mean't as a dig at frontend devs. After all the backend used the values as passed, and there should be some archtectural oversight to ensure this sort of sloppiness doesn't pass review. It's really a case of incompetent all round. As dev I see a push to put more and more functionality into the client. It makes for a better user experience, but the downside is that security gets overlooked.