Should I Verify User Existence in the Database Before Updating Them?

Never assume that user data is safe. Bugs, bad actors, and race conditions can all lead to unexpected behavior. However, in some cases like a straightforward update, if the database returns an error like '0 rows updated', that means the record didn’t exist, so in those scenarios, you might rely on that behavior, but you should always handle errors appropriately if they arise during the update.

A general rule is to always validate on the server side. This way, you don’t have to worry about anything from outside your service being trusted. You can perform updates directly without needing to fetch the record first in many cases, so you’re covered there too!

You typically don't have to check for a record's existence before an update as long as you handle the result. Most databases will just tell you if the update affected any rows. Checking beforehand can open you up to race conditions where the user's status might change between checks. Let the database handle these types of issues—it's built to do that!

Best practices say to never trust any input from a front end. Even if it's for internal use, you never know when that code might be exposed to more users. Always check to ensure the user ID is legitimate, and be aware that hackers will try to exploit any weak spot. It's good to assume that, in development, anything could be exploited.

Defensive programming is key here. You should always validate everything that comes from user input. It's good practice to consider how your code could be exploited or what kind of sensitive information you might expose if you're not careful. Always check the inputs and perform necessary verifications before proceeding with updates.

It's generally not safe to completely trust front end inputs, especially since users can manipulate their interactions. Always validate that the user ID exists in your database before proceeding with updates, and make sure to implement proper authentication and authorization to ensure they have the right to change that user's status. Unless your frontend is completely controlled internally, treating it as potentially hostile is a good rule of thumb.