I know this is an old discussion, but I believe it’s worth rethinking. I believe the assumption that the primary method of obtaining input is HTML is faulty. JSON bodies, either with the application acting as an API server or via channel, are an extremely common use case. Since JSON can pass typed data, the conversion from something to a string is needed. Otherwise, everywhere you need to construct a query against a string field, you need to add defensive programming to ensure that a bad query does not cause an exception and a 500 response.
