I am always amazed how experienced programmers can make such obvious errors when processing user input. Why would I ask for a URL of the WMT account in the quer

I am always amazed how experienced programmers can make such obvious errors when processing user input. Why would I ask for a URL of the WMT account in the query string? I just hope that there is no "for the lulz" guy running a batch script to see how many million URLs he'll be able to remove before this gets fixed.