用户通过身份验证后，我应该关心 sql 注入吗？

Question

Does make sense to check on malicious SQL input from an authenticated user?

Answer 1

An authenticated user can inject queries that bypasses his security settings if such a query doesn't enforce security checks on fields/objects. Also if a class is defined as without sharing, a simple where clause addition such as OR id != null into the query can fetch records that he should not be having access to such as salary statements of his colleagues!!

So in conclusion, all queries must be checked for sql injection.

Answer 2

If authenticated end user drop any data table, then in your view it is not necessary to care about injection, so there is no need to care about that.

Answer 3

Many SQL injection vulnerabilities are not malicious attacks, and won't result in damage. They just result in unnecessary errors that confuse your users and spoil your application's features.

SELECT * FROM Users WHERE last_name = 'O'Reilly'
                                        ^ mismatched quote

Why would you ever not write your code to avoid SQL injection?