none of those issues work because there is a whitelist of specific terms instead of a blacklist

-1 cannot be selected, a lizard isn't on the list of inputs, and my point with the sql is that this isn't a huge attack vector like an input field on a website, this is a dropdown list, essentially.

i challenge you to come up with one relevant attack that isn't order too much of a thing or order conflicting modifications (note of course the modifications are also essentially read from a dropdown list)

everyone here seems to believe that the input field paradigm is not solveable when the inputs are fixed, that isn't true.