Hacker News Reader

For me, one of the primary benefits of ORMs is that they can parameterize requests which then prevents SQL injection attacks.

Passing raw SQL to the database needs very careful attention to the dynamic parts, and it's too easy for user-generated data to be included.

Yes, it's possible to pass user generated text through a sanitizer but now you just have an arms race between the sanitizer and "clever" users.

View on HN

It’s not that hard to pass values as query parameters of a manually written query. With inferior databases that don’t support array parameters it’s a bit more work to construct the correct number of $ parameters in the query, but still not that hard

"Can it be done?" is one question. "Is it done dilligently by all the programmers on the team?" is quite another.

Reply on news.ycombinator.com