Steps to reproduce:
$form = new Form;
$form->addText('email', 'Email:')
->addRule(Form::FILLED, 'Zadejte email')
->addRule(Form::EMAIL, 'Email nemá správný formát');
$form->addSubmit('send', 'Odeslat');
$this->template->form = $form;
paste to input, click to submit:
"><img src=x onerror=prompt(document.domain)>
result:
freeze browser tab