When performing database operations with Frends, you may need to assign some values dynamically, for example when fetching data based on a request sent to an API endpoint you have published with Frends. In these cases it’s important to remember the following golden rule:

Always use parameters to pass values to a SQL query to prevent SQL injections!

If this is not feasible, remember to never pass anything to a SQL query directly from an external source. Validate everything, always, and preferably only use the externally obtained value (such as an HTTP GET parameter) to choose between hard-coded options.

The reason for this is security. Using parameters is an efficient and easy way to avoid SQL injection attacks. Validating the manually input is harder and prone to oversights, so it is not the suggested method

The next article is Introduction to Which SQL Task to use