The SQL injection and ORM's about hacker101 HOT 2 CLOSED

Thanks for your feedback! In the video I say "The safest option is to use an ORM. [...] This completely negates the possibility of SQLi, barring misuse of the library or bugs therein." That is, for all intents and purposes, true. While it's possible to shove the ORM out of the way and start building queries directly -- and introducing SQLi bugs in the process -- it's similar to saying that Python code is invulnerable to buffer overflows, despite that underlying native code could possibly be vulnerable. That is, there are ways that SQLi can pop up even when an ORM is used, but they require a bit of hoop-jumping that shifts the problem onto the developer more than the tools.

from hacker101.

A colleague sent me this link, https://rails-sqli.org/, which pretty solidly shows that I was completely wrong about ActiveRecord particularly, and thus ORMs in the more general sense. I'm going to reopen this and see what can be done regarding either an annotation to the video or an edit. Thanks again for the feedback.

from hacker101.