4 ms·

ORMs do not exist because good developers can't write SQL, they exist to prevent Jr developers, offshore experts and general buffonery running amuck with securi

ORMs do not exist because good developers can't write SQL, they exist to prevent Jr developers, offshore experts and general buffonery running amuck with security issues, database design and proper techniques.

mrits 4y ago
I won't argue why they exist but I would argue that they help with security, database design, or proper techniques. Security - You don't need an ORM to prevent SQL injections. Plenty of libraries handle safe string SQL formatting. Database design - I feel depending on an ORM for this instead of actually thinking about the solution would lead to just as many mistakes. Proper Techniques - It is proper until it isn't I guess. Trying to get the ORM to do things it doesn't support usually leads to unexpected side effects.
- calvinmorrison 4y ago
  You don't need an ORM, it just helps immensely. Here's a recent error I found, and of course, this is a PHP issue, someone used if(empty()) and the value was a string "0" . This evaluated to true, causing a function, that builds up inserts from an associative array (functionally equivelant to say, eloquent's Model::create($data)->save()), to insert NULL instead of "0". Now, we can say that's a php ism, that's just a bug or mistake, but I have found repeated issues like this, especially with legacy PHP code. Going out the gate with something like Eloquent in Laravel, and showing people patterns, really does help. It helps isolate their mistakes, it gives them rails to ride on.
commandlinefan 4y ago
Hm - I've found that the security and performance issues are worse with ORMs than with direct SQL because the developers don't understand (and are actually separated from) what's actually going on.
- KyeRussell 4y ago
  Performance, maybe. Security…I strongly disagree. The 2000s taught us what happens when you don’t make it really really really hard to ‘accidentally’ not parametrise your queries. You don’t need an ORM to accomplish that goal, sure, but every ORM I’ve used will stop you from doing that, pretty much inherently. My experience is that any half decent ORM’s query API will be at least as readable as SQL when it comes to looking for unintentional data access/manipulation.
  - mrits 4y ago
    ORM have their on inherent security issues. Accidentally bringing back all related tables to the user because of referential integrity settings, for example.
lelanthran 4y ago
> running amuck with security issues, database design and proper techniques. What does an ORM have to do with security? Or database design? Or proper techniques? In reality, the ORM leads to poor DB design and even poorer techniques.
- dmux 4y ago
  >In reality, the ORM leads to poor DB design and even poorer techniques. This may be true of the code-to-db type of mapping (where your table definitions are in code and then used to forward-generate the actual database tables) but there is also the possibility of generating an ORM from your database and its relations. I think the real benefit of an ORM is that it's reducing the amount of boilerplate code needed to be manually written in a project.
  - lelanthran 4y ago
    > This may be true of the code-to-db type of mapping (where your table definitions are in code and then used to forward-generate the actual database tables) but there is also the possibility of generating an ORM from your database and its relations. I think the real benefit of an ORM is that it's reducing the amount of boilerplate code needed to be manually written in a project. I agree with this, but when people think of an ORM they aren't thinking of sqlc, which I quite like. The most-used ORMs perform square-peg-round-hole hammering to save the developer doing anything in SQL, they aren't simply saving the effort of writing the boilerplate (like sqlc).
- thworp 4y ago
  The first part is correct, but if you do it properly (translate a proper db design into ORM) it's fine. You can just as well design a catastrophic data model with pure sql.
thworp 4y ago
> database design How does an ORM help with that in any way? Are there any ORMs that will normalize your data model and write apropriate constraints? If so I _have_ been under a rock.

mrits 4y ago

I won't argue why they exist but I would argue that they help with security, database design, or proper techniques. Security - You don't need an ORM to prevent SQL injections. Plenty of libraries handle safe string SQL formatting. Database design - I feel depending on an ORM for this instead of actually thinking about the solution would lead to just as many mistakes. Proper Techniques - It is proper until it isn't I guess. Trying to get the ORM to do things it doesn't support usually leads to unexpected side effects.

calvinmorrison 4y ago
You don't need an ORM, it just helps immensely. Here's a recent error I found, and of course, this is a PHP issue, someone used if(empty()) and the value was a string "0" . This evaluated to true, causing a function, that builds up inserts from an associative array (functionally equivelant to say, eloquent's Model::create($data)->save()), to insert NULL instead of "0". Now, we can say that's a php ism, that's just a bug or mistake, but I have found repeated issues like this, especially with legacy PHP code. Going out the gate with something like Eloquent in Laravel, and showing people patterns, really does help. It helps isolate their mistakes, it gives them rails to ride on.

commandlinefan 4y ago

Hm - I've found that the security and performance issues are worse with ORMs than with direct SQL because the developers don't understand (and are actually separated from) what's actually going on.

KyeRussell 4y ago
Performance, maybe. Security…I strongly disagree. The 2000s taught us what happens when you don’t make it really really really hard to ‘accidentally’ not parametrise your queries. You don’t need an ORM to accomplish that goal, sure, but every ORM I’ve used will stop you from doing that, pretty much inherently. My experience is that any half decent ORM’s query API will be at least as readable as SQL when it comes to looking for unintentional data access/manipulation.
- mrits 4y ago
  ORM have their on inherent security issues. Accidentally bringing back all related tables to the user because of referential integrity settings, for example.

lelanthran 4y ago

> running amuck with security issues, database design and proper techniques. What does an ORM have to do with security? Or database design? Or proper techniques? In reality, the ORM leads to poor DB design and even poorer techniques.

dmux 4y ago
>In reality, the ORM leads to poor DB design and even poorer techniques. This may be true of the code-to-db type of mapping (where your table definitions are in code and then used to forward-generate the actual database tables) but there is also the possibility of generating an ORM from your database and its relations. I think the real benefit of an ORM is that it's reducing the amount of boilerplate code needed to be manually written in a project.
- lelanthran 4y ago
  > This may be true of the code-to-db type of mapping (where your table definitions are in code and then used to forward-generate the actual database tables) but there is also the possibility of generating an ORM from your database and its relations. I think the real benefit of an ORM is that it's reducing the amount of boilerplate code needed to be manually written in a project. I agree with this, but when people think of an ORM they aren't thinking of sqlc, which I quite like. The most-used ORMs perform square-peg-round-hole hammering to save the developer doing anything in SQL, they aren't simply saving the effort of writing the boilerplate (like sqlc).
thworp 4y ago
The first part is correct, but if you do it properly (translate a proper db design into ORM) it's fine. You can just as well design a catastrophic data model with pure sql.

thworp 4y ago

> database design How does an ORM help with that in any way? Are there any ORMs that will normalize your data model and write apropriate constraints? If so I _have_ been under a rock.