jajaj yes it is @dloser
@prohackz
A vulnerability cannot appear in the HTML code (In fact, HTML is not a programming language, is just the skeleton of the webpage), if for example, this form would be managed by a PHP code, and you made a query to a SQL server with PHP, you would have a vulnerability called SQL injection (very easy to fix, but very common on webpages!)
What is SQL injection?: https://www.w3schools.com/sql/sql_injection.asp
I can enter in more details if you want via PM :p