Back-end programming · ⁨Programación backend⁩

A search string changes the query

• A name search receives ' OR 1=1 --. If code pastes it into SQL, the text may change the condition instead of remaining a name.
• A route 路由 maps a request method and path to its handler. Keep the route contract clear before implementing the lookup.

Check shape and permission

• Validate input 校验输入 means checking required values, types, permitted lengths and ranges. Check the caller’s permission separately.
• A status 状态码 describes the result: 200 for this successful lookup, 400 for invalid input and 404 for a missing resource. Permission failures need the application’s agreed policy; they are not automatically bad input.

Keep values outside the SQL text

• SQL injection · ⁨Inyección SQL⁩ SQL 注入 happens when untrusted text becomes part of SQL syntax. A parameterised query 参数化查询 binds a value separately from the statement.
• Placeholders bind values, not arbitrary table names or sort directions. Choose such identifiers from a fixed server-side allowlist when a route needs them.

Run a complete local example

• Save and run this Python example using SQLite. The unusual string is stored as a name, then searched as a bound value.
• The result contains only that named row. Binding prevents this value becoming SQL syntax; it does not establish permission or make every application secure.

import sqlite3

con = sqlite3.connect(":memory:")
con.execute("CREATE TABLE students (id INTEGER PRIMARY KEY, name TEXT)")
name = "' OR 1=1 --"
con.executemany("INSERT INTO students VALUES (?, ?)", [(1, "Mei"), (2, name)])
rows = con.execute("SELECT id FROM students WHERE name = ?", (name,)).fetchall()
print(rows)  # [(2,)]
con.close()

Keep failures useful and private

• Give the browser a clear message it can act on, such as an invalid field or a temporary failure. Do not return raw SQL errors, private credentials or stack traces.
• Record diagnostic details only in protected logs with sensitive values removed. Log enough context to investigate without copying every private request body.

Verify more than a happy path

• Check valid, missing, wrong-type and oversized input; denied access; an empty match; and a simulated database failure. State the expected result for each.
• Keep every dynamic value bound, including dropdown values. The browser’s list does not prevent someone sending a different value directly.