Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Django for example will throw an error if an ordering parameter does not correspond to a database column.

If you have to specify all the columns of a table in Rails, then ActiveRecord ought to be able to restrict the order params to only column names.



I imagine some ORMs don't have this so people can do order by computed columns like "order by assets - liabilities"

To your point it probably makes sense to have an order method that verifies column names and an order_raw method that takes a string so the caller understands the risk, while protecting the usual case.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: