Are the textbox and textarea field types validated in any way against SQL injection attempts? Also, there doesn't appear to be any method of restricting the number of characters that can be entered into the text fields.
I'd like to know more about how secure forms built with Payment Form are?
1. Before the data is saved to database, it is filtered by JRequest class (Joomla core class to handle request, filter data....), so the data is secured before saving to database .
2. There is not max length setting for textbox and textarea in the current version yet. Will add it to the next release !