8 ms·
For me, one of the primary benefits of ORMs is that they can parameterize requests which then prevents SQL injection attacks. Passing raw SQL to the database n
by bruce511 24d ago
For me, one of the primary benefits of ORMs is that they can parameterize requests which then prevents SQL injection attacks.
Passing raw SQL to the database needs very careful attention to the dynamic parts, and it's too easy for user-generated data to be included.
Yes, it's possible to pass user generated text through a sanitizer but now you just have an arms race between the sanitizer and "clever" users.
- jedwards1211 23d agoIt’s not that hard to pass values as query parameters of a manually written query. With inferior databases that don’t support array parameters it’s a bit more work to construct the correct number of $ parameters in the query, but still not that hard
- bruce511 23d ago"Can it be done?" is one question. "Is it done dilligently by all the programmers on the team?" is quite another.