but that’s not the fault of the UI, that’s the fault of the server and/or operator for allowing something like that to be even theoretically possible in the first place.
This is why you place UIs on separate domains from the servers, and always treat user input like it’s radioactive AND toxic.