Is it secure to send messages between a WS Server and the client?

Question

Is it secure to send messages between a WebSocket Server and the Client?

An example of sending messages between a (Socket.io) server, is in Node.js:

socket.on("myMessage", function(msg) {
// "msg" is the message being sent
});

Could a user get / change the client-side JavaScript code, and send some kind of bad message to the server? (e.g., SQL injection)

What are the ways of preventing that?

Another example of using PubNub's API for client side chat apps, that does not use a server:

pubnub.addListener({
  message: function(msg) {
    // "msg" is the message being sent
  }
});

Answer 1

Could a user get / change the client-side JavaScript code, and send some kind of bad message to the server? (e.g., SQL injection)

Given that in almost all cases the server has no sufficient control over the client, it is practically never safe to blindly trust that the client will only send the expected data. This is true for "normal" HTTP requests, API calls, WebSockets, mail, instant messaging ...

What are the ways of preventing that?

Always rigorously verify user input before using it a potentially dangerous way. Also use techniques which prevent injection attacks by design, like parameter binding instead of constructing SQL instructions using string concatenation with untrusted user input.