Updates

dsql-app/package-shared/functions/backend/db/runQuery.js

@@ -11,6 +11,7 @@
 
 const fs = require("fs");
 
+const LOCAL_DB_HANDLER = require("../../../utils/backend/global-db/LOCAL_DB_HANDLER");
 const fullAccessDbHandler = require("../fullAccessDbHandler");
 const varReadOnlyDatabaseDbHandler = require("../varReadOnlyDatabaseDbHandler");
 const serverError = require("../serverError");
@@ -18,8 +19,8 @@ const serverError = require("../serverError");
 const addDbEntry = require("./addDbEntry");
 const updateDbEntry = require("./updateDbEntry");
 const deleteDbEntry = require("./deleteDbEntry");
-const DB_HANDLER = require("../../../utils/backend/global-db/DB_HANDLER");
 const parseDbResults = require("../parseDbResults");
+const trimSql = require("../../../utils/trim-sql");
 
 /** ****************************************************************************** */
 /** ****************************************************************************** */
@@ -89,8 +90,27 @@ async function runQuery({
      */
     try {
         if (typeof query === "string") {
+            const formattedQuery = trimSql(query);
+
+            /**
+             * Input Validation
+             *
+             * @description Input Validation
+             */
+            if (
+                readOnly &&
+                formattedQuery.match(
+                    /^alter|^delete|information_schema|databases|^create/i
+                )
+            ) {
+                throw new Error("Wrong Input!");
+            }
+
             if (local) {
-                const rawResults = await DB_HANDLER(query, queryValuesArray);
+                const rawResults = await LOCAL_DB_HANDLER(
+                    formattedQuery,
+                    queryValuesArray
+                );
                 result = tableSchema
                     ? parseDbResults({
                           unparsedResults: rawResults,
@@ -99,14 +119,14 @@ async function runQuery({
                     : rawResults;
             } else if (readOnly) {
                 result = await varReadOnlyDatabaseDbHandler({
-                    queryString: query,
+                    queryString: formattedQuery,
                     queryValuesArray,
                     database: dbFullName,
                     tableSchema,
                 });
             } else {
                 result = await fullAccessDbHandler({
-                    queryString: query,
+                    queryString: formattedQuery,
                     queryValuesArray,
                     database: dbFullName,
                     tableSchema,