youTellMe@lemmy.world to Programmer Humor@lemmy.worldEnglish · 1 month agoEveryday we stray further from industry standardslemmy.worldimagemessage-square18fedilinkarrow-up11arrow-down10
arrow-up11arrow-down1imageEveryday we stray further from industry standardslemmy.worldyouTellMe@lemmy.world to Programmer Humor@lemmy.worldEnglish · 1 month agomessage-square18fedilink
minus-squaresebsch@discuss.tchncs.delinkfedilinkEnglisharrow-up0·edit-21 month agoGET /api/database?query=SELECT+++name+++FROM+++users+++WHERE+++id=42 I’ve seen that exact type of endpoint, hitting databases in production. 🔥
minus-squaresurewhynotlem@lemmy.worldlinkfedilinkEnglisharrow-up0·1 month agoIf that’s a pass through, that’s bad. If that’s used for authentication, authorization, credential limiting, or rate limiting, then sure.
minus-squaresebsch@discuss.tchncs.delinkfedilinkEnglisharrow-up0·1 month agoThere is no context in this world validating this level of unsanitized SQL. Even for internal use this is bad, since it bypasses the auth of server and dbms.
GET /api/database?query=SELECT+++name+++FROM+++users+++WHERE+++id=42I’ve seen that exact type of endpoint, hitting databases in production. 🔥
If that’s a pass through, that’s bad.
If that’s used for authentication, authorization, credential limiting, or rate limiting, then sure.
There is no context in this world validating this level of unsanitized SQL. Even for internal use this is bad, since it bypasses the auth of server and dbms.