One topic that seems to pop up quite frequently is that the parameter implementation in SEDE allows for SQL injection.
To address this I added typed parameters yesterday, which means you can let us know, when you define the query if a param is an int, a float or a string.
Here is an example of typed params
Out of the box I still allow for the trivial string replace params like: ##whatever##
The thing is that this upsets certain people in particular people feel uncomfortable with stuff like this
The way I see it the whole text box where anonymous can enter whatever query they want is injection central anyway. The security is implemented by running everything given in by users under a restricted account. Now if we had a system where query runners were not allowed to author queries this becomes a totally valid concern.
The reason I added the typed params was to make it easier for people to have text params and not have to escape things like O'malley
My question is:
Are we doing enough? Should we be doing more in the "sql injection protection" department?