Hacker News Reader

It's only an issue if you allow untrusted code to run arbitrary SQL statements, which should never be done.

Do you have a source for that? It seems far more concrete than anything else I've seen.