[steckerbrett]

Ah the old, break the PoC to make the researcher stop complaining move but don't fix the underlying insanity. Classic.

[david_shaw]

My background's in application security assessments. I've seen this hundreds (or more) times, from developers that should really know better.

"Hey, there's SQLi in this input form! Better make sure ' OR 1=1;-- is blacklisted," but don't properly parameterize their queries or sanitize input.

[dsacco]

"Hey, they reported cross-site scripting! Let's blacklist angle brackets, that'll do the trick!"

In case this is not clear to anyone in 2016, blacklisting known-dangerous characters is not an adequate bug fix. It's a rabbit hole, you will burn hours trying to blacklist every character or character combination that can cause a vulnerability just to have someone own you anyway.