Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Forget about sql in 50 lines of python code

github.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Forget about sql in 50 lines of python code

#11

Post by mattmanser »

ecopoesis wrote: post #3

Absolutely, emphatically no. Building SQL strings from user data is a terrible idea. You will have SQL injections. You will compromise your database. I'm sure someone else will add the obligatory link to the Johnny Droptables xkcd. Just learn SQL. It is just not the hard. And please, please use bind variables.

People are actually starring it! Is this some sort of subtle joke?

Just to emphatically underline ecopoesis' point, this code is completely insecure, open to the most basic SQL injection attacks.

Op you need to delete the repo asap.

Re: Forget about sql in 50 lines of python code

#13

Post by jmgutn »

mattmanser wrote: post #11
ecopoesis wrote: post #3

Absolutely, emphatically no. Building SQL strings from user data is a terrible idea. You will have SQL injections. You will compromise your database. I'm sure someone else will add the obligatory link to the Johnny Droptables xkcd. Just learn SQL. It is just not the hard. And please, please use bind variables.

People are actually starring it! Is this some sort of subtle joke? Just to emphatically underline ecopoesis' point, this code is completely insecure, open to the most basic SQL injection attacks. Op you need to delete the repo asap.

Of course I'm not saying this code is suitable for production. It's just a toy "ORM". How you could possibly think I'm trying to replace something like sqlalchemy with 50 lines of code? Please guys, I'm not gonna delete the repo. It's just for fun. I'll add a warning about the sql injection problems and explicitly tell that this code is NOT for production. Event when I think that is obvious.

Re: Forget about sql in 50 lines of python code

#14

Post by [deleted] »

ecopoesis wrote: post #3

Absolutely, emphatically no. Building SQL strings from user data is a terrible idea. You will have SQL injections. You will compromise your database. I'm sure someone else will add the obligatory link to the Johnny Droptables xkcd. Just learn SQL. It is just not the hard. And please, please use bind variables.

[deleted]

Re: Forget about sql in 50 lines of python code

#15

Post by woud420 »

jmgutn wrote: post #13
mattmanser wrote: post #11

Earlier quoted context omitted.

People are actually starring it! Is this some sort of subtle joke? Just to emphatically underline ecopoesis' point, this code is completely insecure, open to the most basic SQL injection attacks. Op you need to delete the repo asap.

Of course I'm not saying this code is suitable for production. It's just a toy "ORM". How you could possibly think I'm trying to replace something like sqlalchemy with 50 lines of code? Please guys, I'm not gonna delete the repo. It's just for fun. I'll add a warning about the sql injection problems and explicitly tell that this code is NOT for production. Event when I think that is obvious.

I don't even think it's ready to be used in a prototype. No joins, no unions, as mentionned before SQL injections. I mean, besides teaching yourself what a basic Mapper is, I don't see any use to this.

Re: Forget about sql in 50 lines of python code

#16

Post by fein »

ORM's are for basic CRUD crap.

SQL is for queries that matter. My ORM usage is almost entirely limited to: get this record, change these values, save it. Anything involving complex joins/ unions gets thrown to raw SQL. Better yet, stored functions on the DB side. Postgres is awesome for this.

Re: Forget about sql in 50 lines of python code

#17

Post by jmgutn »

woud420 wrote: post #15
jmgutn wrote: post #13

Earlier quoted context omitted.

Of course I'm not saying this code is suitable for production. It's just a toy "ORM". How you could possibly think I'm trying to replace something like sqlalchemy with 50 lines of code? Please guys, I'm not gonna delete the repo. It's just for fun. I'll add a warning about the sql injection problems and explicitly tell that this code is NOT for production. Event when I think that is obvious.

I don't even think it's ready to be used in a prototype. No joins, no unions, as mentionned before SQL injections. I mean, besides teaching yourself what a basic Mapper is, I don't see any use to this.

Not just teaching myself. This could teach anyone else that didn't know about object mappers. Even if this is the most insecure code in the world, it can be improved. That's the reason it is on github. You could contribute and add joins, unions, sanitize the user inputs, etc.

Re: Forget about sql in 50 lines of python code

#18

Post by jmgutn »

fein wrote: post #16

ORM's are for basic CRUD crap. SQL is for queries that matter. My ORM usage is almost entirely limited to: get this record, change these values, save it. Anything involving complex joins/ unions gets thrown to raw SQL. Better yet, stored functions on the DB side. Postgres is awesome for this.

Totally agree. This is the reason I wrote this tiny toy "ORM" just for CRUD.

Re: Forget about sql in 50 lines of python code

#19

Post by cjauvin »

I agree with all the comments saying that this is dangerous and not a good idea in general. However I've been doing (and using) something related (more in the spirit of Clojure HoneySQL, as I discovered recently), where the idea is to ease the interop of plain data structures and SQL in a pythonic way:

https://github.com/cjauvin/little_pger

I always got the nagging feeling that I should rather use SQLAlchemy, which probably solves the problem in a more elegant and general way, but this little thing has been working great for me.

Post reply on HN