You're right, unsanitized user input is a risk when its externally crafted. At best in this case, its more sloppy coding then a high security risk.