2 ms·
'You must not convert this to SQL on the client side. You must validate the fields submitted are in your approved list on the backend (indexes/security).' Inte
by capkutay 13y ago
'You must not convert this to SQL on the client side. You must validate the fields submitted are in your approved list on the backend (indexes/security).'
Interesting point. Can't you get around this by only exposing certain tables/fields in the UI based on the users permissions?
- cdcarter 13y agoWhat is exposed in the UI is not always the response you receive back. This is the crux of the mass assignment bug in Rails.
- shebson 13y agoYou shouldn't trust it just because of your UI. With developer tools, regardless of your UI, it would be trivially easy for a malicious user to send any arbitrary SQL query. This would allow them to retrieve sensitive data or modify/delete records from your production database. You really should only build this query server-side, and, as the OP is using PHP, I should also add the caveat that they should use PDO.