> So you can still inject <h1> or <br><br><br>... etc into your username

Are we taking out all the fun of the web? I absolutely loved the <marquee> names people had in the early days of Facebook, it was all harmless fun.

If injection of frontend code takes down your backend, your backend sucks, fix it.