SQL injection in Supabase

Keep filters in the client methods that take a value separately from the column name. Do not pass user text as a fragment of an .or() filter string. If you need a search, use a parameterized RPC:

create function search_notes(q text)
returns setof public.notes
language sql
stable
as $$
  select * from public.notes
  where user_id = auth.uid()
    and body ilike '%' || replace(replace(q, '%', ''), '_', '') || '%';
$$;

Still enable RLS, or define the function so it does not run as a privileged owner. Supabase documents that security-definer functions and views can bypass RLS. Prefer security invoker unless you have a reason and a review.

Never concatenate q into execute format('... %s ...', q) without a format that binds it as a value (%L) and a fixed statement shape.