Injection
These guides are about user input that changes what the server or the browser runs. A SQL string built by concatenation can become another statement. HTML built from user or model text can run in your origin. An upload that keeps the original name, trusts the browser's file type, or is served as HTML from your site can do both.
Guides
SQL injection
User input glued into a SQL string can change the query. The database then runs the attacker's statement with your connection's privileges.
Cross-site scripting (XSS)
User content rendered as HTML runs in your origin. It can read that user's data and call your API as them.
Unsafe file uploads
An upload that trusts the browser's file type, keeps the original name, or serves the file from your site can become stored XSS or a malware host.
Questions
Are Supabase filters safe from SQL injection?
Parameterized queries are. String-building a filter, including passing user text into a .or() filter string, is not. Keep user input in bound parameters.
Is React enough to stop XSS?
React escapes text you put in JSX. It does not escape a string you pass to dangerouslySetInnerHTML, or HTML you inject another way. Render user and model text as text, or sanitize with a maintained allowlist. Do not write a homemade filter.
What should an upload handler check?
Check size and type on the server, store the file under a generated name, and do not serve it as HTML or SVG from your origin. The browser's file input is not the check.