If you have a check constraint with field1 = NULL, this will allow ANY input.
I know = NULL isn't valid. It should of course be IS NULL, but a developer where I work had written "Field1 IN (NULL, 'a')" in the check constraints expression window in management studio. When you click ok there, it changes it to "Field1 = NULL OR Field1 = 'a'"
The users were of course able to put in what ever they wanted in this field
I know IN is the same as =, so NULL shouldn't be written like this, but the bug here is that Field1 = NULL (which should return false), actually is handled as true if used in a check constraint