I can't think of why a site would have a
destroySite function, but it is theoretically possible. More likely would be some sort of search function, which is vulnerable to SQL injection:
I should add that these attack vectors rely on server-side vulnerabilities, and you should shore up your server-side code to protect against SQL injection, and make sure that you authenticate any AJAX requests that should require authentication, before allowing them to change anything on the server.
Essentially, the bottom line is: Never trust user input, and AJAX requests are user input
The right thing to do is to remember where on page the filtered input will be used (in which context - in this one, the URL one) and adjust the filtering accordingly - for example, verify that the scheme is limited only to http:// or https:// .