Yes, the Unicode characters are a problem. But do the norms and tooling play a role here as well? Explicitly casting types, like String parameters to integers

Yes, the Unicode characters are a problem. But do the norms and tooling play a role here as well? Explicitly casting types, like String parameters to integers would make this much more explicit. The convenience of accessing parameters via destructuring, vs explicitly request.getParameter("\u3164"). Having a static array of permissible commands declared elsewhere. There's something to be said for verbosity and explicitness. Where the tooling and norms shun it, these 'invisible' backdoors can gain advantage.