[stephenr]

If at this point you (where you may be a person or a company) still think relying on spicy autocomplete is a smart decision, I can't fucking help you, and you deserve whatever bad things happen to you.

This is akin to saying "we are fully committed to slapping together sql queries directly from request data, but I wonder if it's risky?"

Part of security awareness is knowing when something is simply not worth the risks.