5 ms·

I prefer the control of writing SQL too. However, you have to be careful of SQL injection attacks. Honestly, if you are developing a web app, when you have it

I prefer the control of writing SQL too. However, you have to be careful of SQL injection attacks. Honestly, if you are developing a web app, when you have it working, part of the routine should be to look at the SQL queries for each operation and spot any N+1 issues. I use Django, so this is easy to do in Django Debug toolbar. I'm sure similar tooling exists in other frameworks as well.

isostatic 8y ago
> you have to be careful of SQL injection attacks. Surely you're using prepared statements?!
- mateo411 8y ago
  I've string interpolated SQL queries before... I know I'll only do this for internal apps, not for anything on the public internet. This is not a good practice.