When Feature Creep Turns a Report Generator into a Public SQL Console
A decade of incremental feature requests transformed a device‑log report page from a simple date‑range UI into a free‑form SQL textbox, effectively exposing the entire database. The story shows how tiny UI tweaks can accumulate into an unintended “SQL Injection as a Service” risk, warning data engineers to guard against creeping query interfaces.