16 ms·

If I had to pick, I'd try to make the ORM redundant by making 'lower level' SQL easier to deploy rather than depending on sending strings of SQL queries and mut

by ljm 24d ago

If I had to pick, I'd try to make the ORM redundant by making 'lower level' SQL easier to deploy rather than depending on sending strings of SQL queries and mutations over the wire. I haven't worked in a single setup where raw SQL has been encouraged, because it always requires DB migrations and not all of them are safe. Nobody dares touch the DB server's resources by setting up stored procedures, materialised views, etc. etc. and instead people are blowing money on Redis instances and caching and shit. I don't have an answer to this but I've hit a lot of issues in my career where I think, "this could have been solved months ago by pivoting a couple of tables or creating a new function." You have been able to 'script' the DB for decades but you lose a lot of what you gain from the traditional SDLC at the app layer.

grebc 24d ago
Dapper in .net is fantastic to deal with raw sql, to the point I think I’m delusional because it’s so damn simple to send outrageous queries to the database and have those multiple mixed results turned into objects very simply. I’ve never had an issue of raw SQL requiring migrations? Unless you’re talking of changing database engine? In which case I think it’s a bit of folly to imagine changing the database engine will not mean changes to your stack higher up the chain.
bruce511 24d ago
For me, one of the primary benefits of ORMs is that they can parameterize requests which then prevents SQL injection attacks. Passing raw SQL to the database needs very careful attention to the dynamic parts, and it's too easy for user-generated data to be included. Yes, it's possible to pass user generated text through a sanitizer but now you just have an arms race between the sanitizer and "clever" users.
- jedwards1211 23d ago
  It’s not that hard to pass values as query parameters of a manually written query. With inferior databases that don’t support array parameters it’s a bit more work to construct the correct number of $ parameters in the query, but still not that hard
  - bruce511 23d ago
    "Can it be done?" is one question. "Is it done dilligently by all the programmers on the team?" is quite another.

by ljm 24d ago

grebc 24d ago

Dapper in .net is fantastic to deal with raw sql, to the point I think I’m delusional because it’s so damn simple to send outrageous queries to the database and have those multiple mixed results turned into objects very simply. I’ve never had an issue of raw SQL requiring migrations? Unless you’re talking of changing database engine? In which case I think it’s a bit of folly to imagine changing the database engine will not mean changes to your stack higher up the chain.

bruce511 24d ago

For me, one of the primary benefits of ORMs is that they can parameterize requests which then prevents SQL injection attacks. Passing raw SQL to the database needs very careful attention to the dynamic parts, and it's too easy for user-generated data to be included. Yes, it's possible to pass user generated text through a sanitizer but now you just have an arms race between the sanitizer and "clever" users.

jedwards1211 23d ago
It’s not that hard to pass values as query parameters of a manually written query. With inferior databases that don’t support array parameters it’s a bit more work to construct the correct number of $ parameters in the query, but still not that hard
- bruce511 23d ago
  "Can it be done?" is one question. "Is it done dilligently by all the programmers on the team?" is quite another.