2 ms·
Kind of goes without saying that any framework/library you use must not allow you to write SQL injection vulnerabilities, and if it does you should stop using i
by rwmj 4y ago
Kind of goes without saying that any framework/library you use must not allow you to write SQL injection vulnerabilities, and if it does you should stop using it right now.
- steve-chavez 4y agoSQL injection is always possible with an ORM, since they always allow executing raw SQL as an escape hatch.
- eitland 4y agoTrue. But unlike with the alternative that many end on, raw sql, it doesn't funnel anyone into a place where writing "select * from sometable where id=" + id feels like a logical next step unless you actually have studied the subject or read the manual ;-)