title: firebase javascript injection
body: <p>I want ask something about firebase security. How to handle following situations?</p>
  
  <ol>
  <li><p>User is creating account with <code>createUserWithEmailAndPassword()</code> function, then i save his username,email,created_at...to realtime db. But what if data are not saved correctly. His account is created and he is logged in automatically but data is not stored.</p></li>
  <li><p>I have some registration logic... for example unique usernames... so before creating acc i check if this username exist in realtime db. But he still can call <code>createUserWithEmailandPassword()</code> from js console and account is created.</p></li>
  </ol>