The vulnerability stems from inadequate input sanitization in functions designed to prevent code injection. Both functions use blacklist-based regex checks (looking for patterns like 'select.+from') rather than context-aware output encoding. The advisory explicitly shows these functions were bypassed via HTTP parameter fragmentation and encoding techniques, allowing XSS payloads in comments/notes parameters. The functions' presence in main.inc.php indicates they were meant to provide global protection, but their regex-based approach created a systemic vulnerability.