Databases for Beginners
by Sergey Okinchuk
A Peek at the Query PlannerTopic 38

Chapter Nine · The Real World

Databases in Real Applications

The Marquee's website is live, and nobody who uses it ever types a line of SQL — yet SQL runs on every click, and it is exactly the SQL you spent eight chapters learning. This chapter places your knowledge inside the real architecture: how applications hold connections and speak queries, the one attack every professional must understand, the accounts and permissions that bound the damage, the honest menu of places a database can live, and the libraries that write SQL so you don't have to. By the last page, "the app talks to the database" is not a phrase you nod along to — it is machinery you can draw.

5 topics

For eight chapters you have been the one talking to the database: typing queries, reading rows, booking G7 and G8 in one transaction. Real life is one step removed. Lora's customers book seats from their phones, on a website, and not one of them knows what a SELECT is. Between their tap and the bookings table sits a program — the Marquee's application — and that program speaks fluent SQL on their behalf, over a connection it keeps open all day. The language in the middle of that machinery is the one you already speak.

Five topics complete the picture. First, who actually talks to the database: browsers, app servers, connections, and where your queries physically travel. Then the page this chapter exists for: SQL injection, the twenty-five-year-old attack that happens when an app glues visitor text into its queries, and the parameter mechanism that ends it. Then accounts and permissions, which decide in advance how bad any future mistake can get. Then the geography question: your machine, a rented machine, a managed service, or no server at all. And finally ORMs — the libraries that write SQL from code, and why your SQL literacy is what makes them safe to use.

One click on the Marquee website — where your SQL actually lives
The three-layer picture this chapter draws
The browsera customer's phone or laptop
The app server — holds the connectionbuilds and sends the SQL you learned
The connection — your SQL travels hereSELECT … FROM bookings WHERE customer_id = 214
The databasethe four Marquee tables, guarded as ever

Topics in This Chapter

Topic 38
Who Actually Talks to the Database
Browser, app server, connection, database: one page view traced end to end, with your own query recognizable at the center hop — and why apps share a small pool of connections instead of dialing one per click.
Apps
Topic 39
SQL Injection and Why Parameters Matter
Someone types '; DROP TABLE bookings; -- into the search box. If the app glued that text into its SQL, the visitor just wrote SQL. The attack dissected calmly, and the fix that ends it: data through the data door.
Safety
Topic 40
Accounts and Permissions
The database has its own guest list. GRANT gives each account exactly its verbs on exactly its tables — so when the website account is ever tricked, the worst case was already decided, years earlier, in two lines.
Safety
Topic 41
Where Databases Run
Your own machine, a rented machine, or a managed service where the provider runs the engine — plus SQLite, the database that is no server at all. What changes is the connection string; the skills don't move an inch.
Apps
Topic 42
ORMs: When Code Writes Your SQL
customer.bookings in code, and rows appear — an ORM wrote the JOIN for you. What these libraries automate, where they leak (the 40,001-query mistake), and why SQL literacy separates ORM users from ORM victims.
Apps