5 ms·
Mostly, I think, the problem is SQL injection, and raw SQL is a great place for people to forget to escape their strings.
by kdazzle 11mo ago
Mostly, I think, the problem is SQL injection, and raw SQL is a great place for people to forget to escape their strings.
- jaggirs 11mo agoORM's are not the only solution to SQL injection, pyscopg for example handles string escaping etc for you.
- kdazzle 11mo agoYeah, if you remember to use it properly. SQL injection was pretty rampant before ORMs and web frameworks started being used everywhere. ORMs let anyone make CRUD apps without needing to worry about that sort of thing. Also helps prevent issues from slipping through on larger teams with more junior developers. Or, frankly, even “senior” developers that don’t really understand web security.