3 ms·
Even sqlalchemy has the mechanism I pointed out. I've never seen an ORM not have it because it becomes important if you're putting an ORM on top of a previousl
by crazytony 13y ago
Even sqlalchemy has the mechanism I pointed out. I've never seen an ORM not have it because it becomes important if you're putting an ORM on top of a previously designed database or optimising queries.
session.query(Object).from_statement("SELECT * ...")
http://docs.sqlalchemy.org/en/rel_0_8/orm/query.html#sqlalchemy.orm.query.Query.from_statement http://docs.sqlalchemy.org/en/rel_0_8/orm/query.html#sqlalch...
- X-Istence 13y agoSure, and shooting yourself in the foot is also possible by pointing the gun down at the floor ... doesn't mean it is a good idea. Generally the same statement can be built using internal SQLAlchemy... But if you want to do your own, you can in sqlalchemy while still being as safe: http://docs.sqlalchemy.org/en/rel_0_5/sqlexpression.html#using-text http://docs.sqlalchemy.org/en/rel_0_5/sqlexpression.html#usi...
- roc 13y ago> "Sure, and shooting yourself in the foot is also possible by pointing the gun down at the floor ... doesn't mean it is a good idea." But it's possible and people do it. Which is, I believe the point was, the counterpoint to "SQLi should be impossible". Sure, One can avoid shooting themselves in the foot with an ORM. But that's also true in SQL.