http://maverick.i2p/blog/darknet-dev
But using an ORM does not magically make you safe, because the second you drop into raw queries, dynamic sorting, or string-built filters, the same risk comes back. Stored procedures are not holy either if they dynamically assemble SQL internally. You still validate types, constrain formats, and most importantly run the database account with least privilege so if injection lands, the damage surface is strangled instead of catastrophic.