zakirkun ORM Raw Query Injection
Overview
ORM frameworks like SQLAlchemy, Hibernate, Sequelize, and GORM provide parameterized query builders that prevent SQL injection. However, they also expose raw(), execute(), and query() escape hatches that, when used with string concatenation or f-strings, reintroduce SQL injection vulnerabilities.
Remediation
Use the ORM's parameterized query API instead of raw query methods.
Vulnerable (Python/SQLAlchemy):
db.execute(f"SELECT * FROM users WHERE username = '{username}'")
Safe (Python/SQLAlchemy):
db.execute(text("SELECT * FROM users WHERE username = :username"), {"username": username})