Impact: User input used in FTS without sanitization can produce unexpected results; tokenization affects recall/precision.
FTS queries may be built from raw user strings (special chars, boolean tokens).
Fix:
Always parameterize FTS queries or sanitize special tokens.
Choose/tokenize language appropriately (simple tokenizer vs unicode61) and document.
Add unit tests for edge cases (quotes, AND/OR, punctuation).
Snippet:
SELECT * FROM messages WHERE messages_fts MATCH ? -- use parameter
Impact: User input used in FTS without sanitization can produce unexpected results; tokenization affects recall/precision.
FTS queries may be built from raw user strings (special chars, boolean tokens).
Fix:
Always parameterize FTS queries or sanitize special tokens.
Choose/tokenize language appropriately (simple tokenizer vs unicode61) and document.
Add unit tests for edge cases (quotes, AND/OR, punctuation).
Snippet:
SELECT * FROM messages WHERE messages_fts MATCH ? -- use parameter