4 ms·

ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. For example, Django's ORM protections against SQL injections: https:

ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. For example, Django's ORM protections against SQL injections: https://docs.djangoproject.com/en/2.2/topics/security/#sql-injection-protection https://docs.djangoproject.com/en/2.2/topics/security/#sql-i.... Of course, not all ORMs have this feature.

dmm 7y ago
I think ORM vs concatenated strings is a false dichotomy. Prepared statements or stored procedures also protect against sql injection.
awinter-py 7y ago
variable interpolation doesn't happen at the ORM level, it happens at the driver level pymysql / psycopg2 is doing this piece of it
- taffer 7y ago
  The postgres wire protocol sends queries and parameters separately, the variables are bound on the server side.
UK-Al05 7y ago
In most languages ecosystems I've used have paramatized queries or prepared statements which do this anyway...
- rjmunro 7y ago
  Almost all, except the old php mysql interface. Unfortunately, that happened to become one of the most popular and influential ones.
  - hu3 7y ago
    It was removed in newer PHP versions in favor of mysqli/mysqlnd/PDO which makes prepared statements dead simple.
ben509 7y ago
> ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. Is there a driver out there that doesn't support parameter substitution?
reificator 7y ago
So many people in this thread seem to think that your options are ORM or string concatenation. It explains a lot about why both ORMs and SQL injection are still so prevalent. Does no one teach prepared statements in schools/online classes/textbooks? Does no one go digging underneath their abstractions to learn what they're providing of value and what is easily available without that abstraction? > ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. You can create what's called a prepared statement in most databases. This is a statement that contains placeholders for parts of the query that you want to change at runtime. You then query against this prepared statement, providing arguments for each placeholder. These arguments are typically typechecked and protected against SQL injection. (I only say "typically" because I'm sure someone out there can provide a database/driver combo that does the wrong thing, but I'm equally sure you can find a misbehaving ORM that does the wrong thing as well.)

dmm 7y ago

I think ORM vs concatenated strings is a false dichotomy. Prepared statements or stored procedures also protect against sql injection.

awinter-py 7y ago

variable interpolation doesn't happen at the ORM level, it happens at the driver level pymysql / psycopg2 is doing this piece of it

taffer 7y ago
The postgres wire protocol sends queries and parameters separately, the variables are bound on the server side.

UK-Al05 7y ago

In most languages ecosystems I've used have paramatized queries or prepared statements which do this anyway...

rjmunro 7y ago
Almost all, except the old php mysql interface. Unfortunately, that happened to become one of the most popular and influential ones.
- hu3 7y ago
  It was removed in newer PHP versions in favor of mysqli/mysqlnd/PDO which makes prepared statements dead simple.

ben509 7y ago

> ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. Is there a driver out there that doesn't support parameter substitution?

reificator 7y ago

So many people in this thread seem to think that your options are ORM or string concatenation. It explains a lot about why both ORMs and SQL injection are still so prevalent. Does no one teach prepared statements in schools/online classes/textbooks? Does no one go digging underneath their abstractions to learn what they're providing of value and what is easily available without that abstraction? > ORM protections against SQL injection attacks are worth the clunky syntax. Change my mind. You can create what's called a prepared statement in most databases. This is a statement that contains placeholders for parts of the query that you want to change at runtime. You then query against this prepared statement, providing arguments for each placeholder. These arguments are typically typechecked and protected against SQL injection. (I only say "typically" because I'm sure someone out there can provide a database/driver combo that does the wrong thing, but I'm equally sure you can find a misbehaving ORM that does the wrong thing as well.)