Filter fields to avoid XSS

Yes, it is a real threat, especially since no filtering goes pre-
insertion. We are fine on SQLi though.