In hindsight that should have been enough, but at the time I didn’t want to discard a possibly good candidate because of that (reasoning that maybe he had some reason for it). Being subject to SQL injections also is not the end of the world, everyone makes mistakes. Not realizing it even after me pointing the line could also be overlooked as “we need to train this person”. But insisting that there isn’t even after the interviewer tells you there is, means you don’t want to learn, and at that point I can’t help you.
I use https://silverbullet.md and love it, it’s a bit more than a note taking app, but it’s definitely worth it.