3 ms·

Django's ORM is fine. I would say that it's good but not particularly powerful. Its easy to use and makes inserting / updating data fast and easy. It's simple

by collyw 7y ago

Django's ORM is fine. I would say that it's good but not particularly powerful. Its easy to use and makes inserting / updating data fast and easy. It's simple and fast for simple queries. It starts getting a bit crap when you need complex queries. Annotations / GROUP BY stuff isn't intuitive. It does make it easy for inexperienced people to generate huge numbers of queries by looping through querysets and getting field from another table. It lets you run raw SQL through it and prevents SQL injection, so its really a case of knowing when to switch to that.

sjwright 7y ago
If you're building SQL with string concatenation of data, you've lost. You're not secure. Give up. Parameterised queries are straightforward in all competent languages. If Python can't do it natively, switch to a better language that can.
- collyw 7y ago
  Where did I say I was concatenating data? You might want to take a look at Django's ORM before making comments like that, it handles parametrised queries fine.
  - sjwright 7y ago
    The way I see it, an ORM is just a way of formalising the false assumption that a database is stupid and useless. I've taken a look at a couple of Django's most popular ORM options and I suppose if I was a mid-level corporate cog writing CRUD interfaces for Stack Overflow tutorial-grade operations like customer-sale-item-product relationships it would probably work fine. I've only had passing exposure to that kind of soul-crushing drudge work. For the way I work an ORM is baby stuff, and I'm not even doing anything particularly advanced or sophisticated. I maintain (among other things) a relatively unremarkable bespoke online discussion forum. It comprises hundreds of queries, few of which could be composed correctly by an ORM, let alone composed and run performantly. The median complexity query in my code base probably has two or three joins and two or three subqueries—at least one of which has some kind of tangential aggregation or window function.
    - collyw 7y ago
      > For the way I work an ORM is baby stuff https://www.reddit.com/r/iamverysmart/ https://www.reddit.com/r/iamverysmart/ > a relatively unremarkable bespoke online discussion forum. >It comprises has hundreds of queries Sounds like you have a design issue. Making the unremarkable complex.
      - sjwright 7y ago
        Thanks for the well deserved lesson in internet arguments. You win, sir. (For the record, complexity and remarkability aren't strong correlates. And it's not particularly complex; probably 90% of the app's queries are written for indirect tasks like moderation tools, automations, statistical reports and various stratum of anti-abuse mechanisms. Most common pages only have one security-related query and one content-related query.)

by collyw 7y ago

sjwright 7y ago

If you're building SQL with string concatenation of data, you've lost. You're not secure. Give up. Parameterised queries are straightforward in all competent languages. If Python can't do it natively, switch to a better language that can.

collyw 7y ago
Where did I say I was concatenating data? You might want to take a look at Django's ORM before making comments like that, it handles parametrised queries fine.
- sjwright 7y ago
  The way I see it, an ORM is just a way of formalising the false assumption that a database is stupid and useless. I've taken a look at a couple of Django's most popular ORM options and I suppose if I was a mid-level corporate cog writing CRUD interfaces for Stack Overflow tutorial-grade operations like customer-sale-item-product relationships it would probably work fine. I've only had passing exposure to that kind of soul-crushing drudge work. For the way I work an ORM is baby stuff, and I'm not even doing anything particularly advanced or sophisticated. I maintain (among other things) a relatively unremarkable bespoke online discussion forum. It comprises hundreds of queries, few of which could be composed correctly by an ORM, let alone composed and run performantly. The median complexity query in my code base probably has two or three joins and two or three subqueries—at least one of which has some kind of tangential aggregation or window function.
  - collyw 7y ago
    > For the way I work an ORM is baby stuff https://www.reddit.com/r/iamverysmart/ https://www.reddit.com/r/iamverysmart/ > a relatively unremarkable bespoke online discussion forum. >It comprises has hundreds of queries Sounds like you have a design issue. Making the unremarkable complex.
    - sjwright 7y ago
      Thanks for the well deserved lesson in internet arguments. You win, sir. (For the record, complexity and remarkability aren't strong correlates. And it's not particularly complex; probably 90% of the app's queries are written for indirect tasks like moderation tools, automations, statistical reports and various stratum of anti-abuse mechanisms. Most common pages only have one security-related query and one content-related query.)