Official solution
SimpleUser input concat query. ORM bound params bachata. text()+user mat.
SQLAlchemy injection still if format SQL.
Browser + API ke beech extra darwaze: CORS origin allow, HTTPS encrypt transit, CSRF cookie-auto-send attack, XSS HTML inject, SQL injection raw query.
MAD2 SPA: Vue :8080 Flask :5000 → Flask-CORS. JWT localStorage XSS se chori ho sakta — v-html user input pe avoid. Password Network tab localhost pe dikhega; prod HTTPS, response mein password echo nahi.
401 unauthenticated, 403 unauthorized, 400 validation. Hash one-way — SHA decrypt nahi hota. Secret key .env, GitHub pe nahi.
Example
# bad: f"SELECT * FROM user WHERE name='{name}'"
User.query.filter_by(name=name) # good
Project example: filter_by(name=name) good.