Not really at all the lesson IMO? You could replace the call to `mkdir` with a `psql` call and have the same security hole. The primary issue is with using a s

Not really at all the lesson IMO? You could replace the call to `mkdir` with a `psql` call and have the same security hole. The primary issue is with using a shell/subprocess. Maybe you could make the case that "there tend to be better in-language libs for dealing with databases than filesystems". Not sure that's true, even if it is it's sort of a secondary lesson.