SocketIO: Can hackers send manipulate events to the backend?

If I have something like thisio.on('connection', (socket) => { socket.on('join_room', () => { socket.join(/* ID queried from database */); }); }); Can hackers send an event to manipulate that from the front end?

Submitted February 21, 2020 at 08:30AM by eggtart_prince