DharmaraJ
08/03/2021, 7:53 AMsql
SELECT *
FROM comments
WHERE post_id IN (
SELECT post_id FROM posts WHERE user_id = '1234'
)
silentworks
08/03/2021, 9:12 AMsilentworks
08/03/2021, 9:12 AMDharmaraJ
08/03/2021, 9:20 AMsilentworks
08/03/2021, 9:22 AMsilentworks
08/03/2021, 9:22 AMsilentworks
08/03/2021, 9:24 AM.rpc
method https://supabase.io/docs/reference/javascript/rpcDharmaraJ
08/03/2021, 9:27 AMjs
const userId = "1234"
const {data} = supabase.from("comments").select(`
*
WHERE post_id IN (
SELECT post_id FROM posts WHERE user_id = ${userId}
)
`)
DharmaraJ
08/03/2021, 9:30 AMsilentworks
08/03/2021, 9:30 AMDharmaraJ
08/03/2021, 9:31 AMDharmaraJ
08/03/2021, 9:33 AMDharmaraJ
08/03/2021, 9:33 AMsilentworks
08/03/2021, 9:34 AMuserId
is accessible to the user, they could change it to something like "1234"; SELECT * FROM posts;
and this is a harmless query but people could possible drop tables with that sort of access too.silentworks
08/03/2021, 9:35 AMDharmaraJ
08/03/2021, 9:35 AMDharmaraJ
08/03/2021, 9:35 AMsilentworks
08/03/2021, 9:35 AMDharmaraJ
08/03/2021, 9:36 AMsilentworks
08/03/2021, 9:36 AMDharmaraJ
08/03/2021, 9:36 AMsilentworks
08/03/2021, 9:36 AMDharmaraJ
08/03/2021, 9:37 AMDharmaraJ
08/03/2021, 9:37 AMsilentworks
08/03/2021, 9:38 AMDharmaraJ
08/03/2021, 9:38 AMDharmaraJ
08/03/2021, 9:43 AMsilentworks
08/03/2021, 9:46 AMDharmaraJ
08/03/2021, 9:47 AMsilentworks
08/03/2021, 9:47 AM