3 ms·
We had a post mortem the other day with and engineering manager and some engineers in my team about a really bad security breach (SQL Injection) and this was du
by colesantiago 4y ago
We had a post mortem the other day with and engineering manager and some engineers in my team about a really bad security breach (SQL Injection) and this was due to hand coded SQL in a complex query.
From then on our team we decided to switch to using an ORM rather than doing messy SQL queries that could lead to that incident.
We are currently still hitting hundreds of thousands of queries on the backend and the team not looked back since.
- PaulHoule 4y agoThis. You might have to do a bunch of inserts and updates and want to know all the escaping is done correctly, that insert and update timestamps are handled, etc.
- Silhouette 4y agoYou don't generally need an ORM for that though. The main RDBMSes and the popular APIs for them all support prepared statements that will handle placeholders and escaping for example. And there are lots of query builder libraries that can help to build more complicated SQL queries programmatically without imposing any object model on top.
- PaulHoule 4y agoThose tools blend into each other. If you want to model an inheritance hierarchy as SQL tables that is problematic because there are three ways to do it that all have some good points and some bad points but none of which are completely satisfactory. If you were working in PHP you can make something very simple that looks like an ‘active record’ that writes your INSERTs and UPDATES for you. You could have something like that in Java but you might rather generate some Java Bean stubs to do things that Java way. There’s something to say for “relational-object mapping” that brings relational structures into the OO world of which JooQ is a good example.