On: Password may not contain: select, insert, update, ...

[crumpled]

It's just a string on a page? Or does validation actually prevent you?

[crumpled → crumpled]

I think I figured it out. There is no validation. This is just a contact form and someone sees the plaintext password.