Hacker News Reader

'You must not convert this to SQL on the client side. You must validate the fields submitted are in your approved list on the backend (indexes/security).'

Interesting point. Can't you get around this by only exposing certain tables/fields in the UI based on the users permissions?

View on HN

You shouldn't trust it just because of your UI. With developer tools, regardless of your UI, it would be trivially easy for a malicious user to send any arbitrary SQL query. This would allow them to retrieve sensitive data or modify/delete records from your production database. You really should only build this query server-side, and, as the OP is using PHP, I should also add the caveat that they should use PDO.

What is exposed in the UI is not always the response you receive back. This is the crux of the mass assignment bug in Rails.

Reply on news.ycombinator.com