Yeah, the problem seems to be incorrect validation rules in the code (assuming this "/" input was the real issue). Both "TDD would catch this during coding" an

Yeah, the problem seems to be incorrect validation rules in the code (assuming this "/" input was the real issue). Both "TDD would catch this during coding" and "tests would catch this in regression testing" only hold if there is actually a specification of functionality with the correct input validation rules in the first place. It seems more likely to me this is the more mundane situation that no one was paranoid enough about inputs in the first place.