It's not like this is an obscure corner-case that the developer forgot. In that case I'd agree with you. This is a principal issue. Doing client-side parameter

It's not like this is an obscure corner-case that the developer forgot. In that case I'd agree with you. This is a principal issue. Doing client-side parameter validation for security is a stupid idea in every case. Client-side validation is for user convenience only. This has nothing to do with SQL. Security must be implemented server-side. There are no exceptions to this.