Query input validation is nearly a solved problem. If you don't I would argue this is an incident if in this case 500's are returned.