The Shiny framework, by RStudio, is growing in popularity as a tool that makes it easy for R developers to leverage the web as a deployment platform for sharing their analysis. However, since the very earliest release of Shiny, the development group has been bombarded with the same series questions over and over again, questions like “Does it work with d3.js?” and “Can I use JavaScript in Shiny?”
The Shiny framework is a web application framework for the R programming language, designed by Joe Cheng, to help R programmers turn their analysis into interactive web applications. Fortunately, it does without requiring that the R programmer know HTML, CSS or JavaScript - greatly widening the possible audience of users. At the January DataScience.LA R Meetup, we were fortunate to have Joe Cheng, Software Engineer at RStudio and original architect of Shiny present an introduction to Shiny.
Shiny takes inputs from UI elements and sends them to the server, where the application can access them as R variables. While Shiny has security measures in place, as in any typical web application, it remains the developer’s responsibility to sanitize the inputs before using them. For example, Shiny has no way to protect you if you are using an input in a SQL query such as select ... from ... where field = 'input'. Someone manipulating the websocket communication can craft a specially-formatted input that can force the database to execute a query that it is not supposed to do, termed an SQL injection. This might give an attacker access to private data or the ability to do other nefarious things, and it is a common security issue.