Comment on Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQLparentComments−warmwaffles12yThat's not what OP was saying. That SQL string you just provided is static. At some point the ORM has to assemble that string.−X-Istence12yOP said: > Prepared statements with bind variables only work when the SQL string is static and only the variables change This is wrong.−simonw12yI said "All ORMs build at least some of their SQL using string concatenation"The "at least some" was meant to imply that they also use bind variables.
Comments
That's not what OP was saying. That SQL string you just provided is static. At some point the ORM has to assemble that string.
OP said:
This is wrong.I said "All ORMs build at least some of their SQL using string concatenation"
The "at least some" was meant to imply that they also use bind variables.