Why should you care?

One exposed sort parameter without binding can exfiltrate entire customers table — legal and reputational disaster for a SaaS.

See it live — copy this example

Run in MySQL Workbench or the mysql CLI.

-- App pattern (Node mysql2): use ? placeholders
-- PREPARE from fixed statement:
PREPARE safe_stmt FROM
  'SELECT customer_id, full_name FROM customers WHERE city = ?';
SET @city = 'Pune';
EXECUTE safe_stmt USING @city;
DEALLOCATE PREPARE safe_stmt;

What happened?

• Parameter bound separately from SQL text — city value never parsed as code.
• Same pattern in every language driver.
• DB user should lack DROP, FILE, SUPER.

Practice next

1. Create app_ro user with SELECT only on DataFlow.
2. Run EXECUTE ... USING example.
3. Attempt LOGIN as app_ro and DROP TABLE — denied.
4. Revoke unnecessary GLOBAL privileges from dev users.
5. Enable connection TLS for remote Workbench.

Remember

Bind parameters; never trust input in SQL text. Separate DB users per app with minimal grants. Audit dynamic SQL whitelists.

DataFlow API DB user

Production Node uses dataflow_api@10.% with INSERT/SELECT on six tables only.

Outcome: Stolen connection string cannot drop database.