Should user input be able to cause an unhandled exception? Drupal 7's user login form (and I dare say others) can be tampered with client-side, to cause Drupal to throw an unhandled exception.

All you need to do is change the input fields, appending [] to the name of the name field, and Drupal will create invalid SQL and throw that at the database.

Is this considered a problem? Surely it's Drupal's job to ensure user input is sanitised to the point that it won't generate invalid SQL - is it a DOS risk/security issue?

e.g. Visit drupal.org's login page. Open firebug. Change the &lt;input name="name".../&gt; to &lt;input name="name[]" .../&gt; and add another one just like it. Put some values in both name fields and the password and submit. You get the "This website has encountered an error." page of death.

(I can vouch for this under Drupal 7.35, and on drupal.org which I presume is 7.36)



...
No, user input shoulnd't cause and unhandled exception. Not only because is a nasty reponse form server but it reveals an error condition not handled so it may head to security issues. A non-handled error means that developers are not aware of that error (or they are too lazy, what may be worst).

All error conditions should be handled to minimize problems related to that uncontrolled error.

I've tried to reproduce the bug (with two input name fields with name="name[]" as you have shown in your images) without getting reported error. So I think this
particular case you mention seems to be a drupal.org bug or a module bug of a module used in the Drupal site. You can report the bug in the Drupal.org infrastructure issue queue