It’s not impossible. They could be doing something stupid like running eval on a JSON payload, or generating SQL insert statements from the unsanitised data.

It’s not impossible. They could be doing something stupid like running eval on a JSON payload, or generating SQL insert statements from the unsanitised data. But I doubt it.