>Truthfully though, what wasn't a security nightmare back then in some way?

Collecting data from a form sent via POST to be processed server side?