I've been searching and see many ORMs are changed to Maintenance mode... any suggestion?
#What would be the best ORM (except GORM) for Postgres DB?
amber kelp
gilded quiverBOT
Go Databases and ORMs, https://blog.teamortix.com/posts/2021/08/go-databases - hhhapz
To ORM or not to ORM, https://eli.thegreenplace.net/2019/to-orm-or-not-to-orm/ - Etzelia
Dropping Gorm, https://alanilling.com/exiting-the-vietnam-of-programming-our-journey-in-dropping-the-orm-in-golang-3ce7dff24a0f - Madxmike
halcyon sleet
try https://entgo.io
though, its not ORM and does not have iterator interface.
tawdry linden
State of thought here (mine, overall herders and community members) is that most orms are unidiomatic, slow, and often encourage bad patterns
If you are having trouble building dynamic queries, a query builder is all you should need
squirrel and goqu should fit that purpose
goqu is overall an excellent wrapper around database/sql
amber kelp
how about its security? Better to use the plain database/sql or orm?
tawdry linden
same thing, in both cases, never throw user input into your query
amber kelp
thank you
i do recall when i wanted to get data of a relational tables, with ORM was pretty easy. But not sure if wanna use the database/sql only, should i write so much code for that?
amber kelp
same thing, in both cases, never throw user input into your query
you mean i should use printf() and pass to the query right?
halcyon sleet
No, don't. That's cursed.
ORM might be safer, since you don't write your own query and do some cursed things like constructing query using string function, instead of prepare statement and binding.
boreal knoll
ORMs are no safer than database/sql with parametrized queries
amber kelp
so what would be the suggestion here? use database/sql or orm ?
boreal knoll
State of thought here (mine, overall herders and community members) is that most...
This is the prevailing advice
amber kelp
No, don't. That's cursed.
ORM might be safer, since you don't write your own que...
what do you mean by "that's cursed" ? if don't use printf() what else can use to make sure we sanitize the input before passing it to the sql query?
halcyon sleet
what do you mean by "that's cursed" ? if don't use printf() what else can use to...
printf does not sanitize anything.
waxen lake
Modern DB engines allow you to specify parameterized queries and do sanitization on your behalf.
You can do this without an ORM, while writing your own SQL.
amber kelp
Modern DB engines allow you to specify parameterized queries and do sanitization...
what do you mean by ModernDBs? Postgres doesn't have this feature, afaik...
amber kelp
`printf` does not sanitize anything.
oh... yea that's right.. so i assume the ORMs also don't sanitize the special character..?
boreal knoll
Sanitization is not quite the same as parameterization. Sanitization can fail, parameterization cannot
amber kelp
hmm, that means none of those ORM / libs are sql-injection free?
boreal knoll
The opposite: using parameterization protects you entirely from SQL injection
errant rain
so what would be the suggestion here? use `database/sql` or `orm` ?
Most people here from what I've seen recommend https://github.com/kyleconroy/sqlc or https://github.com/jmoiron/sqlx along with database/sql instead of any ORM. They give you some of the benefits without royally screwing you in the future. In fact the methods they use to solve the cost involved in SQL (code generation or data mapping) are fairly widely accepted as better solutions to ORMs in most modern languages from what I've seen as well.
halcyon sleet
With prepared statement and binding, query and data are send separately. So there is no injection.
Though, both solutions (orm vs not orm) are capable of it.
waxen lake
what do you mean by ModernDBs? Postgres doesn't have this feature, afaik...
Parameterization is what I meant.
amber kelp
thanks guys