sqlstring VS Strapi

As a security professional, I was horrified to find out that the maintainers don't consider this a security issue, though they did promise to take this seriously and change the API when they were made aware of it in 2014 (https://github.com/mysqljs/mysql/issues/731).

So I bumped an issue, noting this is all over HN, and offered to write a pull request for the API change proposed by the maintainers:

https://github.com/mysqljs/sqlstring/issues/60

Doug agreed to accept such a request, so I just sat down to figure out the code and a reasonable upgrade plan.

Three hours later, I proudly wrote Doug this email (pasting it here because the issue and codebase are locked to non-contributors so I had to send it via email):

OK, I have a draft pull request ready. Of course, it's a big change and I expect to get a lot of feedback and have a few rounds of back and forth and fixups before it is accepted.

This is the plan as I envision it:

* Release SqlString 3.0.0 that has a new allowObjectValues parameter defaulting to false. This is a new major, so it shouldn't break anybody's code.

Strapi provides a centralized data managing platform. This makes it easier to organize, update, and maintain the FAQ data. It also automatically generates a RESTful API for accessing the content stored in its database.

https://prisma.io is popular as I understand it. I've been trying out https://strapi.io the last week and am thoroughly impressed.

They both do much more than build queries. One big thing both do is automate database migration calculations. Strapi goes further and gives you a CMS and admin UI on top, as well as doing a lot more of the complex query building from a json object. Both still require a fundamental understanding of the data model and SQL

As of April 2024, Strapi's GitHub repository has garnered 59.7k stars and 7.5k forks, showcasing its widespread adoption. The project has also secured a substantial $45+ million in funding, cementing its position as a prominent player in the headless CMS space.

const pages = await client.GET("/pages", { params: { query: { filters: { // @ts-ignore - openapi generated from strapi results in Record // https://github.com/strapi/strapi/issues/19644 path: { $eq: path, }, }, // @ts-ignore populate: { blocks: { populate: "*" }, }, }, }, });

On a side note. Where do all these endpoints come from? Strapi is open source. We can read the source code. All these endpoint come from the Users and permissions plugin. So, if we go to Strapi on github and browse around the files a bit eventually you will find the auth.js file that contains all of the routes. You can also find the Strapi controllers in there if you're interested.

Strapi

Strapi: The Code Anarchist

Strapi - Open source Node.js Headless CMS 🚀