Comment on Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQLparentComments−simonw12yI said "All ORMs build at least some of their SQL using string concatenation"The "at least some" was meant to imply that they also use bind variables.
Comments
I said "All ORMs build at least some of their SQL using string concatenation"
The "at least some" was meant to imply that they also use bind variables.