They often rely on CMS modules and plugins to take care of input like this and those programmers didn't want to have to parse and sanitize the input, they just had to control it completely and fageddubautit

Edit: yeah I was once one of them ...