Glua / SQL good practices
Hello everyone !
While I'm still learning Glua, I've tried doing some thing here and there with the local sv.db SQLite database built-in Garry's Mod. Well, using SQL isn't as hard as it thought it would be.
That's exactly what I said before learning about SQL injections and prepared statement, escaping, essentially everything that brings some security to avoid being hacked by the first smart kid for whatever reason.
Honestly, I don't even know if using theses security measures in a local database makes any sense at all, and the facepunch wiki ( which I find very helpful for a begginer btw ) don't seem to cover security aspects of SQL.
So, I wanted to know first if in a local environment, would it makes sense to secure a SQL database ? If so, does anyone have tutorials, any resources that might help me to learn about all that ?
Thanks !
No need unless your queries are sent from the client (should not be the case, lua handles this mostly)
Thank you for the answer !
Actually none of my queries are sent from the client though. I did find the sql.SQLstr function I was looking for escaping queries, and looking at the SQLWorkbench tool coded by William Venner, there's definitely a way to use prepared statements too.
Still don't know if security makes sense in a local environment, the fact someone disagreeing with your answer makes me think : yes it does.
In a purely local environment, as in, you and only you will be the only person to ever have access, it doesn't really matter.
But as soon as you let someone else on, or use that code somewhere else, it matters. It's also useful to get in the habit of good security practices, even in environments where it doesn't matter, as it'll be ingrained in you when you are in an environment where it matters.