Add SQL injection check for custom query

[kdhrubo]

https://www.digitalocean.com/community/tutorials/sql-injection-in-java

[thadguidry]

From that article:

Limit the application’s access to the database via permissions & grants.

That's the very first thing and last thing that really makes all the difference.
So many ways for hackers to get around asking for the secret things from a db.
The best defense, is don't even expose extra schema, tables, views, etc. that an app doesn't need. Make new views or tables and restrict the app user account to only those instead.
If there's auth needed for an app to support multi-tenancy, and the auth is doing lookups to a db table... that's already starting off on the wrong foot. They should instead use an IAM system like Azure Entra, or whatever in Amazon and others, AND a Zero Trust Architecture.

[susanta-mukhopadhyay]

This is indeed a good idea, but how can we achieve it? Do we have any control over database access configurations or we will request users to create less privileged accounts to be used in our API generation?

[kdhrubo]

@susanta-mukhopadhyay @thadguidry The custom query has been removed in favor of parameterized query coming soon. Hence closing this topic