3 ms·
There's another big aspect of ORMs a lot of people tend to skip in discussion: Security. Raw SQL can be dangerous, and given enough people and code somebody wi
by d4mi3n 7y ago
There's another big aspect of ORMs a lot of people tend to skip in discussion: Security.
Raw SQL can be dangerous, and given enough people and code somebody will eventually make a mistake (as is human) and introduce a vector for a SQL injection attack or some other DB specific vulnerability.
A good ORM can be a fairly effective layer of safety.
- GordonS 7y agoWhen people talk of using "raw SQL", I (hope!) they generally mean using paramaterised queries, which mitigates against most injection attacks.
- hardwaresofton 7y agoIMO it is a humongous red flag if someone on your team talks about "raw SQL" and does not mean parametrized queries. I guess I could say I was fairly fortunate in my education/early career but this is a lesson you have to learn early when working with user input and databases.
- mgkimsal 7y agooften they don't mean that - they really do just mean "run any sql you want". just worked on a project that explicitly wrote their own bolted on 'db layer' and avoided the built-in ORM which had parameterized query support. i now know what 1200 sql injection-capable queries look like...
- dillonmckay 7y agoThe last two projects I inherited were both using raw SQL with parameterized queries, different languages/frameworks.
- bunderbunder 7y agoIt can be, but it is hardly the only solution to that problem. I've also seen it solved, for example, with a git commit hook that just bounced any non-parameterized queries.
- d4mi3n 7y agoOh certainly. Any good security is done in layers. A way to sanitize SQL, however you do it, is one of them.