Isn't it? It might be naive, but I would not expect that: 1. Accepting user input on a webpage (e.g. a first_name field on a singup form) 2. Storing that user

Isn't it? It might be naive, but I would not expect that: 1. Accepting user input on a webpage (e.g. a first_name field on a singup form) 2. Storing that user input in a database Would trigger a RCE if the string was escaped properly.