My main reason to use ORM and why I recommend to others to use it (specially if they are juniors) is because it usually (depending on the language/framework) co

My main reason to use ORM and why I recommend to others to use it (specially if they are juniors) is because it usually (depending on the language/framework) comes with great support for protecting against SQL Injection. Of course not all ORMs will protect against SQL Injection completely and some of them will only implement partial protection. But it is a good start. What I recommend strongly is not to mix ORM with plain SQL in the same line of code. The code should either be full ORM or plain SQL so that it is clear where the responsibility of protecting against SQL injection should be. Edit: Also it is easier to add extra layers of protection after a while if using an ORM then when using plain SQL. Because with an ORM I can redefine lets say the Repo.all or Query.all method to add extra layers of protection. But with plain SQL I need to edit every single line where the SQL statement is present.