There's been a claim that the GA state "My Voter" site is vulnerable. I'm not poking at it any more than looking at visible source (too pretty for jail and all). But it implements client side filtering and allows backticks in the name fields. 1/n 
Even with identical server side filtering, that could lead to eventual command injection, depending on how the data is used. Remember that the command injection could happen later, long after it is originally inserted in a database. 2/n
Client side filtering isn't all bad, but if it's used as a replacement for server side filtering, that's where you can get into trouble. When we see client side filtering in penetration tests, it's about even odds that there's no server side input validation (or it's broken) 3/3
