The API MUST assume all input given to it is untrusted! Care MUST be taken to ensure SQL injections do not occur, especially in update related queries