DEV Community

Discussion on: SQL is Insecure

Collapse
 
ben profile image
Ben Halpern

If I ran a software consultancy tasked to take on a greenfield project, what approach and technologies might I choose if I want to avoid using SQL, but still want to use a practical approach that's not going to slow down development too much?

Collapse
 
miffpengi profile image
Miff

I would like to know this too. Neither NoSQL nor an ORM allows full access to the power of a modern database engine.

Collapse
 
kellogh profile image
Tim Kellogg

To be quite honest, all options are going to be slower or have some thorn. SQL injection is simply too terrible of a problem to be allowed to survive. We've tried educating developers. It didn't work. More education isn't going to fix this. Yet in the meantime we've got huge problems - elections being compromised, identities being stolen, livelihoods being crushed. We, as developers, need to to take responsibility for our own code as well as those who might modify our code.

Ideally we should start seeing relational databases where injection attacks aren't possible (or at least difficult). But in the meantime there is Redis, Cassandra/DynamoDB, TitanDB, RethinkDB, and literally hundreds of other options.