Do I get this right that jQuery, for developer convenience, content-sniffs the value of "data-" attributes?

I.e., if the value looks like JSON, it will parse it and return the object tree, otherwise it will return the original value as a string?

This sounds like a horrible idea in general - I'd say the authors of this forgetting that certain english words by themselves are valid JSON is a nice cherry on top but hardly the worst problem caused by this.

Sort of - there's a jQuery API that does content sniffing called .data(), it's for storing and retrieving arbitrary data on elements. The problem was that they used this API to read from an element where they should have used .attr(), which returns a string.

Now I want to change my name to NaN

you probably don't, if the story about the cars with plates on a variations of "NO PLATE" is any indication https://www.snopes.com/fact-check/licensed-to-bill/

Maybe try car plate sql injection. :D http://1.bp.blogspot.com/-URBVGKEBRss/U0GgQetIwEI/AAAAAAAAC2...

Wow. Problem one: applicant writes "no plate" instead of leaving it blank or writing in a crossed line. Problem two: so do the law enforcement officials! The former is a silly mistake; the latter should be a learning opportunity.