topic Re: queryFeatures SQL Injection in ArcGIS JavaScript Maps SDK Questions

queryFeatures SQL Injection

AddisonShaw — Mon, 31 Jul 2023 16:28:54 GMT

Looking at integrating queryFeatures into our application to segment a large feature service by client.

We have concerns about SQL Injection with this approach as it would be somewhat trivial to modify the client-side where clause to return whatever data you want from a layer.

How are we supposed to handle this use case? Is it possible to proxy a feature service through a backend service that itself is using something like the ArcGIS REST API? That way we could essentially hide the query implementation from end users.

Re: queryFeatures SQL Injection

JohnGrayson — Thu, 03 Aug 2023 21:41:41 GMT

Not sure if it helps in your specific use case, but if you are using an online hosted Feature Layer I would suggest you check out the capability to create hosted Feature Layer View and it's ability to configure filters.

Re: queryFeatures SQL Injection

AddisonShaw — Fri, 04 Aug 2023 17:47:52 GMT

That could definitely work! Do you have a link to documentation for how to call it programmatically?