[kdazzle]

Mostly, I think, the problem is SQL injection, and raw SQL is a great place for people to forget to escape their strings.

[jaggirs]

ORM's are not the only solution to SQL injection, pyscopg for example handles string escaping etc for you.

[kdazzle]

Yeah, if you remember to use it properly. SQL injection was pretty rampant before ORMs and web frameworks started being used everywhere.

ORMs let anyone make CRUD apps without needing to worry about that sort of thing. Also helps prevent issues from slipping through on larger teams with more junior developers. Or, frankly, even “senior” developers that don’t really understand web security.