Object-Relational Mapper ¶

When taking a look at object-relational mappers (ORMs) we are concerned with a few things in particular:

• Is the ORM using bound parameters for all the different backends? We must verify each one.

• Can developers write raw SQL queries using bound parameters, or does it just use string interpolation behind the scenes?

• Is the documentation clear about the risks of writing raw SQL queries with user input? What escaping mechanisms are provided to escape user-supplied data?

---

• Version: latest
• Edited by Craig Younkins on 7/26/10 1:35 PM
• History
• Edit

Wiki content is available under a Creative Commons 3.0 License.