Vulnerable By Design...no, Really

A Zscaler researcher describes repeatedly finding legitimate websites that intentionally accept JavaScript and full SQL/HTML in URL parameters—resulting in XSS-by-design, SQL-query exposure, and unsafe include patterns. The post highlights widespread insecure coding practices that could enable XSS or SQL injection exploitation, though the author did not perform active tests and reports no confirmed exploitation.