Hacker News Reader

There's a classic injection attack when interpolating in the SQL query

Also as others have mentioned RGB space and human perceptible color space is different enough that distance in RGB doesn't equate to difference/similarity between colors

View on HN

No, it isn't. What is interpolated in the string comes from an object containing predefined set of strings. I don't allow the user to type anything they want. I didn't want to clutter the tutorial

Can you be more specific on the SQL query attack?

I can't see any client data in the query, so how would anything be injected?

Reply on news.ycombinator.com