https://datasciencela.github.io/tag/security/Recent content in security on DataScience.LAHugo -- gohugo.ioen-usDataScience.LA, 2014–2021 · Read-only archive: comments are closed.Mon, 12 Jan 2015 09:41:19 -0800https://datasciencela.github.io/secure-your-shiny-apps-against-sql-injection/Mon, 12 Jan 2015 09:25:12 -0800https://datasciencela.github.io/secure-your-shiny-apps-against-sql-injection/<p><a href="http://shiny.rstudio.com/">Shiny</a> takes inputs from UI elements and sends them to the server, where the application can access them as R variables. While Shiny has security measures in place, as in any typical web application, it remains the developer&rsquo;s responsibility to sanitize the inputs before using them. For example, Shiny has no way to protect you if you are using an input in a SQL query such as <code>select ... from ... where field = 'input'</code>. Someone manipulating the websocket communication can craft a specially-formatted input that can force the database to execute a query that it is not supposed to do, termed an <a href="http://en.wikipedia.org/wiki/SQL_injection">SQL injection</a>. This might give an attacker access to private data or the ability to do other nefarious things, and it is a common security issue.</p>