I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like:
I then realized you can also enter:
into the post content box. Is there a way to hook into the validation and make it so that script can't be entered?
Am I wrong in thinking that a hacker with access to the backend could use the fields to get malicious script to the database?
I guess I'm just a bit confused because when using the settings api ( or even creating custom metaboxes ) there's so much emphasis put onto proper validation/escaping. Yet, on post pages you can enter whatever you want? Thanks!