DEV Community: Avash Karn

SQL Injection Protection in Flask: A Practical Guide. Part 5 of e2ee chat series

Avash Karn — Fri, 29 May 2026 03:01:29 +0000

The Problem

Most developers think their database is safe. It's not. SQL injection attacks can destroy everything.

What is SQL Injection?

If you write code like this:

query = f"SELECT * FROM users WHERE username = '{username}'"

An attacker types: admin' OR '1'='1

Your query becomes:

SELECT * FROM users WHERE username = 'admin' OR '1'='1'

All users exposed. Game over.

The Solution: Parameterized Queries

Never use f-strings for queries. Use parameters:

from flask_sqlalchemy import SQLAlchemy

db = SQLAlchemy()

user = db.session.execute(
    db.select(User).where(User.username == username)
).scalar()

SQLAlchemy automatically escapes dangerous characters.

Why It Works

Database treats input as DATA, not CODE
Even if attacker types admin' OR '1'='1', it's treated as literal string
Safe from injection

Common Mistakes

Using f-strings for queries ❌
Not validating input ❌
Trusting user data ❌

Conclusion

Always use parameterized queries. Never build queries with string formatting.

Building an E2EE Chat App in Flask - Part 4: Real-Time Messaging with SocketIO

Avash Karn — Tue, 26 May 2026 10:04:11 +0000

Building an E2EE Chat App in Flask - Part 4: Real-Time Messaging with SocketIO

Hey! So far we covered encryption, passwords, and file uploads. But how do messages show up instantly without refreshing?

The Problem: Polling vs Real-Time

Without real-time, your app is dead:

User sends message
Other user refreshes page
Message appears or they don't refresh message won't appear
Sucks, right?

The Solution: SocketIO

WebSockets = open connection between client and server. Message goes instantly.

from flask_socketio import SocketIO, emit, join_room

socketio = SocketIO(app, cors_allowed_origins="*")

@socketio.on('send_message')
def handle_message(data):
    message = data['message']
    channel = data['channel']

    # Save to database
    new_post = Post(content=message, channel_id=channel)
    db.session.add(new_post)
    db.session.commit()

    # Send to all users in channel
    emit('receive_message', {'message': message}, room=channel)

How It Works

User sends message
Server receives via flask-SocketIO
Server saves to database
Server broadcasts to all users in channel
Everyone gets message INSTANTLY

Why This Matters

No refresh needed. No delay. Real-time = better UX.

What's Next

Part 5: Database design and security.

Questions?

Building an E2EE Chat App in Flask - Part 3: Keeping File Uploads Safe

Avash Karn — Sat, 23 May 2026 02:43:26 +0000

Okay hi, so imagine you have a mailbox at your house. Anyone can put things in it, am I right or am I right? What if someone puts a bomb in there? Or trash? You need to check what goes in before it causes problems.

That's what file uploads are like. Users can upload anything. We need to stop the bad stuff.

The Problem: Bad Files

When I first built my chat app, I didn't think about what users could upload. They could upload:

Files with viruses hidden inside
Really huge files that break the app
Weird file types that cause problems
Files with tricky names designed to hack the system

It's like leaving your house door open and hoping bad people don't come in. Spoiler: they will.

My Solution: Check Everything

I learned to be a security guard for my app. Here's what I do:

1. Only Accept Certain File Types

First, I made a python Set of file types I actually want:

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'mp4', 'mov'}

I only allow images (png, jpg, gif) and videos (mp4, mov). That's it. No .exe files. No .zip files. Nothing unsafe.

Then I check every file:

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

All that code just says: "Does the file have a dot? Is it one of our allowed types? If yes, cool. If no, reject it."

2. Clean Up Bad Filenames

Here's something sneaky: attackers might upload a file named something like "../../../admin.php" to try to escape the upload folder and hack the system.

So I use a function that removes all the dangerous stuff:

from werkzeug.utils import secure_filename

filename = secure_filename(file.filename)

If someone uploads "../../admin.php", this function turns it into "admin.php" (harmless).

If someone uploads "file (1) [2023].jpg", it cleans it up too.

3. Organize Files by Type

After the file is safe, I check what type it is:

def get_file_type(filename):
    ext = filename.rsplit('.', 1)[1].lower()
    if ext in {'mp4', 'mov'}:
        return 'video'
    elif ext in {'png', 'jpg', 'jpeg', 'gif'}:
        return 'image'
    return 'file'

So if someone uploads a video, I store it in the videos folder. Images go in the images folder. Everything stays organized and safe.

Why This Actually Works

Think about it like airport security:

Whitelist = Only let through what's allowed (like a passenger list)
Clean names = Remove anything suspicious (like checking luggage)
Organize = Put things in the right place (like baggage claim)

If you don't do these checks, bad stuff gets through.

What Actually Happened

I built this without thinking about security. Then I realized: what if someone uploads a virus? What if they upload a 1GB file? What if they try to hack the system with a weird filename?

So I added these checks. Now my app is safer.

The Real Lesson

Never, ever trust what users do. Always assume someone is trying to break your app. Check everything.

What's Next

Part 4 is about real-time messaging. How do messages update instantly without refreshing? WebSockets.

Let me know what you think!

Building an E2EE Chat App in Flask - Part 2: Secure Password Storage

Avash Karn — Fri, 22 May 2026 09:26:50 +0000

Hey everyone! Part 1 explained encryption. Now let's secure passwords.

The Problem: Plain Text Passwords

In my first version, I stored passwords like this:

if user and user.password == p_word:
    # LOGIN

This is TERRIBLE because:

If database leaks, everyone's passwords exposed
No hashing = no protection
One breach = account takeover

The Solution: Werkzeug Password Hashing

Use werkzeug.security to hash passwords:

Registration:

from werkzeug.security import generate_password_hash

hashed_password = generate_password_hash(password)
user = User(username=username, password=hashed_password)
db.session.add(user)
db.session.commit()

Login:

from werkzeug.security import check_password_hash

user = User.query.filter_by(username=username).first()
if user and check_password_hash(user.password, password):
    session['logged_in'] = True
    # USER LOGGED IN

Why This Works

Passwords are hashed (one-way)
Hash can't be reversed
Even if leaked, passwords stay safe
Industry standard
Built into Flask ecosystem

What I Learned

Passwords must NEVER be stored in plain text. Ever.

Part 3 Coming

File uploads and validation.

Questions? Drop them below!

Building an E2EE Chat App in Flask - Part 1: Why Encryption Matters

Avash Karn — Fri, 22 May 2026 07:33:47 +0000

Hey everyone! I'm building an encrypted chat application in Flask and documenting the journey. Here's Part 1.
Why E2EE Matters
Most messaging apps claim to be secure, but they're not. Your messages sit on their servers where anyone with access can read them.

End-to-End Encryption (E2EE) = only you and the recipient can read messages. The server can't see anything.

Example:
WhatsApp uses E2EE. Facebook Messenger doesn't. Your choice matters.

Why I Built This
I wanted to understand encryption by building it, not just reading about it. This project taught me way more than any tutorial.

What's Next
Part 2: How to handle passwords safely without storing them in plain text.

Questions? Drop them in comments!