Question from the Web security - Basics test

When user input is directly used in the application as-is

When HTML forms use the correct validation (required, minlength & maxlength, min & max, type)

When parameters are in the query (?param1=value1&param2=value2 at the end of an URL)

When parameters are in the body (a POST call with json or multipart/form-data for example)