The person you’re replying to is being needlessly condescending, but I suspect what they’re getting at is that having a mindset of “what possible undesirable/ma

The person you’re replying to is being needlessly condescending, but I suspect what they’re getting at is that having a mindset of “what possible undesirable/malicious inputs are possible from this web form?” really precludes this scenario. Using unbounded text fields for a web form is a serious rookie move, as it’s a very obvious form of undesirable/malicious input. Point being, if you mess that up, what more subtle and dangerous inputs might you also be leaving yourself open to?