JavaScript’s “strict” exists to remedy a number of language footguns which exist because JS as a language was cobbled together in like a week and is, in general, pretty busted. Even in strict mode JS has far, far more footgun-type issues than Elixir. For example: 0 is falsey, 64 bit integers don’t exist (ORMs have to use strings, it’s ridiculous), the == vs === situation, etc.
Elixir code is actually very safe because as Elixir developers we often write our code with a lot of explicit validation. For example, the case statement I showed you will raise an error if an untrusted value is passed in - same for the guard version I provided. Most other programming languages are not so explicit about such things (especially JavaScript).
The need to validate your inputs, though, has nothing to do with Elixir or Phoenix. If you were writing your application in JavaScript you would still have to validate what the client sends you - and it’s the same for any framework! Learning to write code in this way helps prevent security issues. It’s a defense-in-depth strategy.
If you had ignored my advice above and used your code, you probably would have been fine. But because this is a forum where people come to learn, it’s important that we provide advice which follows best practices. Sometimes I’m wrong too and someone else corrects me 
But if that happens, it’s important that I go back and fix my post, otherwise someone could pop in from a search engine, learn the wrong thing, and close their tab without ever finding out!
