8 ms·
I still struggle with ORMs. SQL is... declarative. If you're working with multiple RDBMSs, sure? Maybe I want my local dev to be sqlite and scaled be postgres?
by ryoshu 1y ago
I still struggle with ORMs. SQL is... declarative. If you're working with multiple RDBMSs, sure? Maybe I want my local dev to be sqlite and scaled be postgres? I've never run into that in production. A DSL on top of a DSL doesn't make a lot of sense.
- lmm 1y agoSQL is just extremely bad on top of being poorly integrated with the host language. Middle-endian order, terrible abstraction capabilities, no test support to speak of, essentially no project management tooling... I use ORMs so that I can write the thing I want to do in a vaguely reasonable language, just like I manipulate XML datastructures in code instead of writing XSLT.
- ozgrakkurt 1y agoCan’t relate this comment to the article. They can’t just run user sql on DB because they are changing internal db schema between releases. And they can’t implement real sql because it is massive compared to some simple query dsl
- dec0dedab0de 1y agoI just want to write one language at a time if I can. I like sql when querying directly, almost as a UI of sorts, but it’s not my favorite when I am just trying to get my code to work, and the database is a relatively minor detail.
- never_inline 1y agoHow do you do conditional filters in pure SQL from a backend Java / Python app, without doing string concatenation? Not a fan of all the proxy object circus ORMs do but I'd leave row-> domain object mapping and filter building to some library. Sweet spot is probably something akin to Android Room / Micronaut Data JDBC.
- sgarland 1y agoSQL has CASE statements, if you’d really like to have all branching logic in pure SQL.
- paulddraper 1y agoString concatenation
- Xss3 1y agoNo, we must build 16 more layers of pointless abstraction in a new DSL.
- minitech 1y agoQuery builders that operate at the SQL level. (A popular example of that in Python is SQLAlchemy Core, but there are better ways to do it, especially in better-typed languages.)
- yencabulator 1y agoI was just pondering, for a little Rust project of mine, whether to suffer some weird ORM-smelling query builder, or to just build the AST with https://github.com/apache/datafusion-sqlparser-rs/ https://github.com/apache/datafusion-sqlparser-rs/ and convert to string..
- crazygringo 1y agoWhat's wrong with string concatenation?
- whatevaa 1y agoGuaranteed source of bugs in complex cases.
- crazygringo 1y agoMore complex cases are more likely to have bugs period, just in their logic. String concatenation isn't really a major source of that. Just make sure your parentheses match, as you need to do no matter what, and include a space at the start and end of each string to make sure you don't accidentally smush terms together likethis.
- t-writescode 1y agoSimpler SQL injection risk and more testing to make sure all potential branching paths don’t result in invalid SQL.
- webstrand 1y agoThere's zero danger of sql injection so long as everything is being passed by parameters. You just concatenate placeholders when you need string concatenation to build the query.
- crazygringo 1y agoExactly this. And if you're testing, you've got to test every query combination anyways. It's not just syntax that can be wrong, but logic and performance.
- foobazgt 1y agoJOOQ (http://jooq.org http://jooq.org) is pretty fantastic for this, and it's my go-to for working with RDBMs' on the JVM. It provides a DSL-like API that lets you write pretty much any SQL you need in a type-safe way (without string concatenation).
- chillfox 1y agoMy main issue with ORMs is they always end up being just another thing to learn, adding needless complexity. They are not an alternative to SQL as you always end up having to understand what kind of SQL they create and how it works for either performance or complex queries.
- t-writescode 1y agoHand-rolling SQL inside another programming language comes with some unpleasantness, like protecting against SQL injection and making sure the SQL is valid, especially when hand-constructing the query based on input parameters: “sort ascending? Descending? Filter all but things in this group? etc.” Parameter management in some languages are unpleasant, like how JDBC only has positional arguments; and any time you do string concat in a language, you start getting in danger of misformed SQL. Ultra basic ORMs, like Exposed (Kotlin), are well-tested frameworks that do exactly what I want. Want a single value in the =? Or want it to be an “in”? Or what if it’s null? Handled. No special string management. Want parameters? Handled. When I see pure ORM’d code, I can feel safe expecting it to be protected from injection and formatting issues. It’s reduced cognitive load and greater safety. When I see raw string SQL management, I have to put another layer of care and attention to try and make sure (and maybe still fail) there’s no application-crashing mistakes in that part of code. It’s kinda like working with typed and compiled code. Greater protection from error.
- monkeyelite 1y agoYou’re arguing against a straw man. All major language sql libraries are not based on string manipulation and provide things like escaping, arguments, etc out of the box.
- ameliaquining 1y agoOnly for parameterization over scalar values. If you want to do any kind of composition more sophisticated than that, you're either stitching together strings or using some kind of more heavyweight abstraction like an ORM.
- monkeyelite 1y agoThat’s because the composition is supposed to be inside sql. Views, functions, etc. This is another reason why the ORM is a leaky abstraction - it hides all the best features from you.