SQL injection: are ORMs 100% safe?

Question

We use an ORM (Prisma/Sequelize/Entity Framework) everywhere, so our team assumes SQL injection is impossible. Is that true?

Accepted Answer

Mostly safe, **not** 100%. ORMs parameterize values in their standard query builders, but injection comes back through the escape hatches:

1. **Raw queries built with string concatenation**:
```ts
// ❌ vulnerable
prisma.$queryRawUnsafe(`SELECT * FROM users WHERE name = '${name}'`);
// ✅ parameterized (tagged template)
prisma.$queryRaw`SELECT * FROM users WHERE name = ${name}`;
```
2. **Dynamic identifiers**: column names for sorting, table names. Values get parameterized, identifiers can't be. **Allow-list** them:
```ts
const SORTABLE = { newest: 'createdAt', score: 'score' } as const;
const column = SORTABLE[req.query.sort] ?? 'createdAt';
```
3. **Operator injection** in document or JSON-style filters: e.g. passing `{ "$ne": null }` from request JSON straight into a MongoDB or Sequelize `where`. Validate input types with a schema (zod) so strings stay strings.
4. **Raw fragments** in `orderBy`, `literal()` and similar helpers.

Audit with a quick grep for `Unsafe`, `raw(`, `literal(`, `FromSqlRaw` and string templates near SQL keywords.

1 Answer