What if I was to tell you that the "n+1 query problem" only happens when you misuse ORMs? I know, "no true scotsman" and all that :) Ok... what if I was to tel

What if I was to tell you that the "n+1 query problem" only happens when you misuse ORMs? I know, "no true scotsman" and all that :) Ok... what if I was to tell you that you can get SQL injection with stored procedures? I worked for a company where we had that problem. I hadn't written them, but I knew that was impossible so I bet my boss that's not the reason. And then I looked at them and discovered they were doing something like s = "SELECT * FROM table WHERE id =" + @id and then exec_sql s (I don't remember the exact syntax, but it was something like that.) Misuse of what a stored procedure is supposed to do? Yeah, so's the "n+1 query problem" with ORMs... Though I will grant you that the second one is much easier to get wrong, the guy who wrote the SP had to work to make it vulnerable to injection...