How to say you’re vulnerable to code injection without saying you’re vulnerable to code injection.

I wonder, if you turn off JavaScript, does it allow you to perform SQL injections?

Is the front end the only thing protection or is the backend “also” doing work?

Little Bobby drop tables