3 ms·
That command will have to take some input from neural network though? And we're back in Bobby Tables scenario
by VTimofeenko 9mo ago
That command will have to take some input from neural network though? And we're back in Bobby Tables scenario
- zahlman 9mo agoNo, that argument makes no sense. SQL injection doesn't happen because of where the input comes from; it happens because of how the input is handled. We can avoid Bobby Tables scenarios while receiving input that influences SQL queries from humans, never mind neural networks. We do it by controlling the system that transforms the input into a query (e.g. by using properly parameterized queries).
- VTimofeenko 9mo agoRight, in DBs it's proper param binding + prepared statements. I see what you're saying, makes sense. FWIW there is (in analytics) also RBAC layer, like "BI tool acting on behalf of user X shall never make edits to tables Y and Z"