Exactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported. In the unlikely

Exactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported. In the unlikely event that someone reading this doesn't understand why server-side sanitation of any user input is always required, xkcd.com/327 provides an amusing take.