I commented in a discussion on HN (I know…) titled "When your last name is Null, nothing works".
I wrote that this is terrifying, because it implies that so many computer systems interpret user-supplied data instead of treating it as out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.
I then read the replies and now I am even more terrified 😳