6 ms·
Most developers I know aren't writing any SQL, and if they are, you might (not necessarily) have an even bigger problem[1]. ORMs are a valuable abstraction. It
by mangeletti 11y ago
Most developers I know aren't writing any SQL, and if they are, you might (not necessarily) have an even bigger problem[1].
ORMs are a valuable abstraction. It's no good to go about your coding life without a care in the world for SQL, just because ORMs exist, but it's even worse to write an app littered with SQL, which is a language most likely entirely unrelated to your app.
1. I audited a code base for a friend a few weekends ago, and it was littered with SQL injection vulnerabilities, because the developer didn't like ORMs.
- 7sigma 11y agoYou don't necessarily need ORMs. If the developer had used prepared statements (e.g. PDO in php), then there would probably have been a lot less vulnerabilities.
- matwood 11y agoHand concatenating SQL is also not a good thing. Prepared statements and/or something like JOOQ (which is my goto in Java nowadays) would have prevented most if not all of the injections. Sprocs also go a long ways towards preventing SQL injection. One could still build sql statements through concatenation inside the sproc I guess. /shudder.