General DB Questions

[Creed17]

I'm interested in creating a user database for a program I am designing in python. I have done lots of research, but I'm still not sure about some parts and how I should go about this.

So my client application will not be a webapp and instead will be a GUI program.

I'm wondering how I can securely create and manage a user the "proper way".

My first thought was to have the client program connect directly to the DB and create a user and manage itself. I've seen this before, but only with flask/django.

I soon realized this might not be the proper way to do it because these functions would be executed on the flask server while mine would just be executed on my program.

So how do I go about managing a DB (for non-trusted users) on an application.

I was thinking about making some sort of API to communicate with my client program that manages the database, but I'm not sure.

Ideas?

[micseydel]

If you're creating a GUI program, it's going to run on the user's device, right? If I'm understanding that part correctly, could you elaborate a bit more about non-trusted users? Could you point a picture of the undesirable situation you'd like to avoid?

[Creed17]

If you're creating a GUI program, it's going to run on the user's device, right? If I'm understanding that part correctly, could you elaborate a bit more about non-trusted users? Could you point a picture of the undesirable situation you'd like to avoid?

The device the program will be run on will be limited. I'm building this program to run on top of the operating system.

By non-trusted users I mean general consumers. I don't users to do any harm to the database by having the program connect directly to the database. Now I'm not quite sure what
undesirable situation I want to avoid. I understand SQL injecting and such, but I want to avoid any harm that could be done to the database.

So I guess what I'm looking for is how to securely have my program interact with the database without having undesirable situations.

Should I have my program connect directly to the DB to create and manage the user or should I use an API instead to communicate with the DB?