They could do it, and probably should do it, as it would reduce the load on their server by a massive amount, but since it deals with user input, someone has to write and test input sanitization checks, so I'm guessing that's probably low on their list.