‫What's going on, guys, quick video answering one question that some of you asked me, and I started
‫writing an answer, but it turns out to be the very loaded question I can't possibly and threatened
‫in a comment.
‫Right.
‫So I decided just to quickly make some some more content for you guys in answering this question.
‫So how about we jump into it?
‫So this question comes from Shark Week and it's a comment on my no, just spinning up a lightweight
‫postscripts and a stance and work with it or no.
‫Yes, right.
‫And basically the question says, hey, I currently have the same set up on my side project.
‫And what do you think about having to create to call create a table, if not exist, running on startup
‫that creates the table and then start your application?
‫Is this a good idea or bad idea?
‫So just I'm rephrasing what he has here is he has the application when it starts, it can act as a user.
‫And the first thing it does, it creates the table if not exists.
‫So there is like a command special skill command center created, if not exist and then consume the
‫work.
‫So most of the cases, that's absolutely fine.
‫And however, I I'm a little bit of a when it comes to this kind of DDL operations, I do not like to
‫do them in the script.
‫Sometimes I don't have a choice.
‫But in this case I what I would do is I would make sure, first of all, that the user consume the database
‫used in this case, consuming the table that is doing DTMF ls on the table and searching, updating,
‫deleting is different than the user who owns the schema or on the table is just a practice that I learned
‫over the year.
‫I like to have a different owner, right.
‫And this way I assign specific permissions to the user doing the DMS operation.
‫So if the same user and I'm going to tell you in a while why in a second if you're doing what you're
‫doing right now, which is you spin up the application and fairly, this is exactly what I did at the
‫application.
‫But that's.
‫Goes without saying that this is not production code, right, but what I say is like when you spin
‫up the application and you immediately create a table by default, you on the table.
‫So you pretty much can do pretty much anything with it.
‫And that's not a good idea, because if that application are you going to start spin it up to be a Web
‫application, which will have a lot of other consumers which are anonymous.
‫Most of the time they are going to use the identity of their user to doodle on that table.
‫Right.
‫So that's insert whatever if you support deletes or updates that stuff.
‫In that case, that user, those users have full privileges on the table.
‫So if you if someone managed to sneak in and a sequel injection on you to drop the table, they will
‫be able to drop it because guess what?
‫Yes, they are anonymous from the player.
‫But the moment that that that injection happened, excess or whatever happened and it reached your backend
‫application, it can sneak in into the database.
‫Right.
‫And basically had select from your name as semicolon drop table employees.
‫And just like that, you lost your table.
‫Right.
‫Because and they can do that because they are here on the back and they are logged in as you use and
‫you configure that they are the owner of the user.
‫So if they just sneak in, they can drop the table.
‫Bad idea, right?
‫So what I like to do is.
‫So I would not recommend what you are doing in production, so that's the short answer.
‫What I would do is I would create the schema using a completely different script.
‫Right.
‫And I'm going to create it as a specific user.
‫I don't know, I'm going to call it app schema, right?
‫I'm going to create the employee stable in this case, and then when I want to consume, I'm going to
‫create a completely different user for the application.
‫I'm going to call it app user and that app user.
‫I'm going to be even a hard ass, a more hard ass, I'm going to create a different database users and
‫create different pools of connections because you have to use pooling.
‫I didn't use pulling that video, but you have to.
‫Guys, I'm going to create a different pool of connections for each round of application.
‫If the drought is going on doing only reading, then I'm going to log in as a read only user and give
‫that user app read, for example, and give it read permission on that table.
‫And if I am going through the route that is I don't know anything, then I'm going to do give it only
‫update.
‫I'm not going to give a drop privileges because most of the time you're not going to drop a table in
‫the web.
‫So why do you give it a full permission?
‫Right.
‫Just having the full permission is just really scary.
‫Right, to access it through the web.
‫And I apologize.
‫Shark Week, bad ass name.
‫By the way, if you're not using this in a Web application, you're completely doing as a script that
‫you have absolutely no users.
‫Whatever I'm saying does not make any difference, right?
‫You can absolutely use your approach right if you want to, you're on your script to set up the script,
‫then absolutely.
‫By all means, do it and do this, if not create.
‫And this is actually a great idea, especially if you're running a huge script that does a bunch of
‫stuff you want to be able to make it.
‫It's important so you can run it over and over again.
‫And just the they call additive, right.
‫Just adds on top of each other.
‫All right, guys, quick video.
‫I want to just to answer this question.
‫It took me seven minutes to answer.
‫So that's by no means I could have answered that in a comment.
‫So I hope that makes sense, guys.
‫And I'm going to see on the next one, you guys stay awesome and asked me these great questions.
‫Keep quiet.
‫Keep them coming.
‫I love you.