SQL injection: when data becomes instructions
String concatenation turns user input into executable database commands. Why escaping strings fails and parameterized queries always win.
The engineering questions you get asked, and the bugs you actually hit. Drawn, one mechanism at a time, in the order the videos ship.
String concatenation turns user input into executable database commands. Why escaping strings fails and parameterized queries always win.
A relational database stores facts once and assembles the answer when you ask; a document store keeps the answer assembled and pays when it changes — and joins, schema, sharding and consistency are that one trade seen from four sides.
An isolation level is a list of what is still allowed to happen to you — and the half a ninety-second video has to cut: the retry loop serializable makes you write, the statement that has to come first, the anomaly the standard never named, and what your database's default actually is.
Four promises, one disaster each — and the setting that makes an application less reliable the moment you turn it up, unless you also write the retry loop nobody mentions.
A hundred sub-millisecond queries, a four-second page, and the two cuts the video could not afford: a batched second query is two points in time, and a thousand ids in an IN list is a problem of its own.
The planner never ignored it — it priced it. The two things the video could not say safely, then everything else it cut: index-only scans, partial and multicolumn indexes, trigrams, BRIN, statistics, HOT updates, bloat, and what LIMIT does to a plan.