Can’t they though? Presumably there would be a form that validates inputs that they can use. Part of the problem that OP described is that they were writing directly to the “database” (and OP had to validate input afterwards).