2 ms·
Im writing an app that customers will use. Will it be a good idea to write an app that accepts sql queries directly in the request payload. But these endpoints
by andrewvijay 10y ago
Im writing an app that customers will use. Will it be a good idea to write an app that accepts sql queries directly in the request payload. But these endpoints have authentications too. Where it can possibly go wrong?
- gcatalfamo 10y ago1) Is this over SSL? 2) Why not prepared statements?
- andrewvijay 10y agoYup it is over SSL. Prepared statements? What does it mean? You mean building the query in the server?
- chatmasta 10y agoWhat if your "customer" is malicious? Just because they're authenticated doesn't mean they won't try anything nefarious. If your app is marketed as directly interacting with a database using SQL language, then I can see why this would make sense. But in that case, you should definitely make sure that every customer interacts with an isolated database from a non-root user. That way they can fuck up the data all they want, but it will only be their data.
- andrewvijay 10y agoYes I had the same thought but I just wanted to know how many vectors other than this will be possible. Let's say the customers are not doing anything like that. Now do we have any other vectors?