7 ms·
They do, but what we're talking about here is an ORM, so there will always be machine generated SQL somewhere. Or do you believe that GP is suggesting that deve
by qxcv 14y ago
They do, but what we're talking about here is an ORM, so there will always be machine generated SQL somewhere. Or do you believe that GP is suggesting that developers use parameterised SQL queries instead of an ORM?
- untog 14y agoEr, why can't the ORM use paramaterised queries?
- jeltz 14y agoThe problem is that ORMs like ActiveRecord really are just domain specific languages for building queries. If these DSLs use inband are carelessly constructed (e.g. they use some form of inband signaling) you can do the injection attack against the actual ORM code and make it build queries the author of the code did not intend.
- sontek 14y agohttp://sqlalchemy.org/ http://sqlalchemy.org/ is an ORM and does not have these security issues. So it can be done.