hunting-orm-and-query-builder-injectionlisted

# Hunting ORM and query-builder injection: when the abstraction is not the safeguard Teams reach for an object-relational mapper or a query builder partly to avoid injection, then assume the abstraction handles it. It handles values: a bound parameter is safe no matter what it contains. It does not handle structure. The moment untrusted input becomes a column name, a sort direction, a raw fragment, or an operator inside a filter object, the placeholder machinery is bypassed and the query means something the developer did not write. Classic string-concatenation injection is largely gone from ORM codebases; the live risk moved to the escape hatches and the structured inputs. You find it by separating the calls that bind values from the calls that accept structure and tracing untrusted input into the latter. ## When to use - Data access goes through an object-relational mapper or query builder, not hand-written statements. - Untrusted input reaches a raw-query method, a column, table, or sort argument, or a filter object. - Request bodies are passed as filter or update objects into the data layer. ## Scope check Test injection only against databases and applications you own or are authorized to assess, on non-production data. Confirming an operator-injection read can expose records outside your test scope. If you can't name the authorization, stop. ## The loop 1. **Map the data-access sinks and separate them.** Inventory where the mapper or builder is used, then split