2 ms·
Hm - I've found that the security and performance issues are worse with ORMs than with direct SQL because the developers don't understand (and are actually sepa
by commandlinefan 4y ago
Hm - I've found that the security and performance issues are worse with ORMs than with direct SQL because the developers don't understand (and are actually separated from) what's actually going on.
- KyeRussell 4y agoPerformance, maybe. Security…I strongly disagree. The 2000s taught us what happens when you don’t make it really really really hard to ‘accidentally’ not parametrise your queries. You don’t need an ORM to accomplish that goal, sure, but every ORM I’ve used will stop you from doing that, pretty much inherently. My experience is that any half decent ORM’s query API will be at least as readable as SQL when it comes to looking for unintentional data access/manipulation.
- mrits 4y agoORM have their on inherent security issues. Accidentally bringing back all related tables to the user because of referential integrity settings, for example.