Equally terrifying and dangerous are database commands being injected through your site. If you know or suspect that user input is being put into the database without safety escaping it server-side, you can enter SQL code to end the intended call and start your own call instead... such as listing the contents of tables (passwords, user info, etc), altering info, or simply deleting those tables. SQL injection is too easy to screw up for new devs, and even many seasoned ones.
And I say "server-side" because if you rely only on client-side scrubbing, someone will find some clever way to bypass that. Remember, your HTML and Javascript are sent in full form to the client in plain text, and many browsers have dev tools that let you alter a page's html as you view it. And if those browsers didn't provide the feature (to legitimate, well-meaning users), it would still be available as a separate tool to people trying to break in. Client-side validation is for creating a friendly user interface; server-side is where you handle security.
Without exception, all user data is evil. Anything you receive in POST or GET, anything going into the database, anything and everything spawned by the user or potentially having come in contact with him is evil, because users are inherently evil and you cannot afford to forget that at any point in the website. You must scrub every bit of data (on the server side), escape everything you receive or process, and possibly still regard it with suspicion after it's verifiably clean (including in how you store that information to keep it secure). And then you need to worry about scripts injected into your website by frames, advertisements, and other invaders. You need to worry about fraudulent e-mails being sent to your users. Ultimately you need to worry about countless attack vectors that grow by the day, and every web dev everywhere has to be an expert because the languages and other tools they use expect them to know and handle it themselves.
And if the tools handled it, hackers would figure out where those tools make mistakes and attack from that angle. I've yet to see an easy, complete answer to the problem, though knowledge and defensive design go a long way.
In summary, the web is a pile of venom-tipped bear traps dotted with pies; Happy Scrubbing! :D