7 ms·
Do anyone here expose real sql querying capabilities to your users?
by adrianhel 7y ago
Do anyone here expose real sql querying capabilities to your users?
- tluyben2 7y agoIn a dark past my company did: because these users were paying CMS users, they would not try to hack things, but rather because of the power of SQL and their lack of knowledge, they broke a lot which required backups to restore. We are talking mid 90s and Perl CGI scripts.
- adrianhel 7y agoThat sounds kind of terrifying.
- siscia 7y agoRead only access to a replica databases seems quite a sensible choice for me. If along you expose not the the real tables but views I honestly don't see what could go wrong.
- asdfasgasdgasdg 7y agoThe main thing I can think of is that migrations would become much more painful, because your API is the entire capability surface of the relational database you're using -- no more and no less. Hyrum's Law suggests that your users will come to depend on every facet of it. Then again, no doubt there are some cases where this is the best solution. But it's worth being cautious before adopting an approach like this.
- kerblang 7y agoThe parent poster's grammar is kind of bad but I think their idea is to expose only views, not actual tables, so there is some degree of dependency immunization. Views are a pretty good poor person's substitute for an API right & proper.
- nicoburns 7y agoCould you not have given them read-only access?