I wasn't defending ORM's. I was just pointing out that if you use one you do receive protection from injection attacks. Just because only part of the ORM is ac

I wasn't defending ORM's. I was just pointing out that if you use one you do receive protection from injection attacks. Just because only part of the ORM is actually performing the protection doesn't change the fact that you have it as a consequence of using the ORM. You can also get the same protection by using a SQL library that supports prepared statements. But ORM's still provide that benefit.