Preventing SQL Injection in Bubble + WYSIWYG Plugin

[Blake]

Seems like this is the only other post on the topic here in the forum.

How can I force a single quote (') or % character in my SQL LIKE query?

Here’s what I got from Bubble support: Short Answer: use this format: ‘%’ || $1 || ‘%’ Long answer: We use Postgres’ query-escaping mechanism to safely send parameters to queries to avoid SQL injection attacks. So, we don’t actually replace the $1 on Bubble’s end. We use Postgres’s PREPARE statement (https://www.postgresql.org/docs/9.6/static/sql-prepare.html) to build a query with a placeholder, then send the value separately. What this means is that you can only use $ values in places wher…

So I’m going to guess there’s nothing we need to do (like like limiting character types on input fields) in order to prevent SQL injections ?
But XSS might be another topic…