Input elements

If url would work, there isn't any functions which checks if user is typing special characters. User could type html or sql into input eements and possibly break the database(for example).