top | item 45559174

(no title)

kdazzle | 4 months ago

Mostly, I think, the problem is SQL injection, and raw SQL is a great place for people to forget to escape their strings.

discuss

jaggirs|4 months ago

ORM's are not the only solution to SQL injection, pyscopg for example handles string escaping etc for you.

kdazzle|4 months ago

Yeah, if you remember to use it properly. SQL injection was pretty rampant before ORMs and web frameworks started being used everywhere.

ORMs let anyone make CRUD apps without needing to worry about that sort of thing. Also helps prevent issues from slipping through on larger teams with more junior developers. Or, frankly, even “senior” developers that don’t really understand web security.