I vote "all three." One of the problems with web development is that there is always someone smarter and may know something you don't, so look at this as an opportunity to improve something, and learn something new in doing so.
There will always be someone nit-picking at your work to steal jobs. It's the way it is. My favorite is "memory leak", followed by these technical nit-picks, which the client most likely doesn't understand but is scared to death by it. Your job is to sort the wheat from the chaff and allay their fears, one way or another.
Rather than argue the point, just grab the bull by the horns and change it. Make sure the data is exactly what you expect, even if you leave it in an array. Set up a demo, throw some mySQL and XSS injection strings at it, display the result. The client won't understand that either, but they will see you're addressing the issue proactively.
Even though this is a friend, whatever you do, don't address it with the client the way you have here, contesting their claims. All it does is turn it into a p***ing match, and it always ends badly. When you visit a couple and they start fighting, do you choose sides?
No. You say "It's time for me to go . . . "
but the value is limited to that of the radio buttons so what would be the point?
Because they can.