SQL Injection is a kind of attack done by adding SQL quires to the URL of the application. Such queries execute on the DBMS without having legitimate access to it. Such attacks are possible if there are some branches into the code. Let's see some code to understand it better:
dbGetQuery(conn, paste0( "SELECT * FROM City LIMIT ", input$nrows, ";"))
As we can see in the preceding code, input$nrows has been put directly into the query. If an attacker got access to this input$nrows, they could inject any SQL statement into it. In this case, the solution can be to prevent an attacker from passing vectors. So, the code can be modified as follows:
dbGetQuery(conn, paste0( "SELECT * FROM City LIMIT ", as.integer(input$nrows)[1], ";"))
The input is converted into an integer first. So, if an attacker puts some SQL into it, it...