Preventing SQL Injection in Bubble + WYSIWYG Plugin

[sridharan.s]

I assume Bubble prevents against SQL injection in all input fields, etc. Can anyone confirm?

Additionally, with the new Vanilla Rich Text Editor (i.e., WYSIWYG), I confirmed with it’s author that the HTML text is being converted to plain text on the client and then Bubble stores it as plain text. So, I assume this makes the HTML from this plugin also guarded against SQL injection, right?

[jvelasquez]

Can someone from bubble please answer this? I think is crucial to know if we have to do something from our side

[elaf]

@emmanuel

[Blake]

Seems like this is the only other post on the topic here in the forum.

How can I force a single quote (') or % character in my SQL LIKE query?

Here’s what I got from Bubble support: Short Answer: use this format: ‘%’ || $1 || ‘%’ Long answer: We use Postgres’ query-escaping mechanism to safely send parameters to queries to avoid SQL injection attacks. So, we don’t actually replace the $1 on Bubble’s end. We use Postgres’s PREPARE statement (https://www.postgresql.org/docs/9.6/static/sql-prepare.html) to build a query with a placeholder, then send the value separately. What this means is that you can only use $ values in places wher…

So I’m going to guess there’s nothing we need to do (like like limiting character types on input fields) in order to prevent SQL injections ?
But XSS might be another topic…

[lois.laput]

@emmanuel @kathleen @grace.hong UP. Think this is important for security purposes

[silviorodriguez95]

Any updates on this?