This exactly. Any text field is "checked" to see if it is getting submitted unprotected to a database. Every single one of them. When you run a search engine y

This exactly. Any text field is "checked" to see if it is getting submitted unprotected to a database. Every single one of them. When you run a search engine you will see queries that try to look through every page of results for the search query 'input type="text"' typically this will either come from an API query or to a search page that is fronting another index.