3 ms·
Might be a good idea if you arr the only one on the team or if everyone is like you. If not, be prepared to check for sql injection vulnerabilities the first n
by eitland 4y ago
Might be a good idea if you arr the only one on the team or if everyone is like you.
If not, be prepared to check for sql injection vulnerabilities the first n PRs from any new team member.
Also to explain how to do it and your reasoning for it.
- rwmj 4y agoKind of goes without saying that any framework/library you use must not allow you to write SQL injection vulnerabilities, and if it does you should stop using it right now.
- steve-chavez 4y agoSQL injection is always possible with an ORM, since they always allow executing raw SQL as an escape hatch.
- eitland 4y agoTrue. But unlike with the alternative that many end on, raw sql, it doesn't funnel anyone into a place where writing "select * from sometable where id=" + id feels like a logical next step unless you actually have studied the subject or read the manual ;-)