On: Show HN: Dataherald AI – Natural Language to SQL E...

[DaiPlusPlus]

SQL injection meets prompt-injection…

[panarky → DaiPlusPlus]

NEVER CREATE CARTESIAN PRODUCTS

For example:

SELECT clicks.session_id, clicks.page_url, sessions.user_id FROM clicks, sessions;

(This context is guaranteed to generate lots of cartesian products.)

[calcsam → DaiPlusPlus]

Couldn’t you solve this simply by executing from a user without these permissions?

[newaccount74 → calcsam]

Sure, but it's something that the customer has to do. I wouldn't rely on customers to configure everything correctly, especially if there is no way to discover the configuration error before the damage has been done.