Entity Framework 4.0 Scaling and Security

I want to use an ORM, and have been looking at EF 4. Is this platform scalable. I 开发者_C百科see a lot of stuff on the web, but everything looks very biased in one way or the other. Anyone know of benchmarks or non-subjective information.

On that point, does EF prevent SQL injection or XSS. I know that it used parametrized queries, but is that enough?

Any help is appreciated.

Okay so i see two questions here.

Is EF Scalable

Very difficult (and subjective) to answer, but IMO yes.

Here's a few reasons why:

• Utilizes a common querying language (LINQ)
• Allows for multiple providers (SqlServer, Oracle, etc)
• Allows bi-directional mapping (code first, model first, database first)
• Includes "classic ADO.NET" support (stored procedures, Entity-SQL)

The main real benefit in scalability is how the framework is built on LINQ-to-Entities. When you write queries, you are not writing against SQL Server or Oracle, you are writing against the Model. Depending on what Provider you have setup (in web.config), EF will translate these model queries into the appropriate T-SQL (or P-SQL).

Therefore (theoretically), you could write code against SQL Server, then change the web.config provider to Oracle, and your code should work. Obviously this isn't the case for Entity-SQL though (as you are writing T-SQL, not LINQ).

Does EF prevent SQL injection or XSS

No ORM tool can really "prevent" SQL Injection attacks - they can only provide the developer with the tools to prevent it.

As with classic ADO.NET where you use parameterized queries, Entity Framework has Entity-SQL, which allows to to execute pre-generated SQL, stored procedures, etc.

In this scenario, you need to use parameterized queries to prevent SQL injection. For most EF work, you will be writing queries with LINQ, which is a lot safer because it gets hydrated through a lot of stages before it becomes SQL.

XSS is exploited on the client-side via things like injected JavaScript, dodgy emails, etc. Has nothing to do with Entity Framework. Prevention of XSS is done on the client-side with things like HTML encoding.

No. ORMs are not a panacea for scalability. There is such a things called the impedance mismatch of objects and databases which has been around for many years. ORMS try to solve this by providing magic code generation/mapping solutions that give the appearance of just working with objects.

In a multi-tier environment with many client programs and a single/many server scenario, for every change that has to be committed to the database, checks need to be performed to make sure that your not over writing someone elses change on the data, or trying to update data that has been removed. This is not a new problem introduced by ORMs but one which appears many many times throughout the ages of updating databases in N-Tier environments. ORMS do not solve this problem. In some cases, if the ORM is the single entry to the Database, the ORM becomes a bottle neck. This means that to create a scalable architecture using an ORM becomes problematic as having DB checks performed on the ORM means that the update anomaly checks could be by passed if your using an N-Tier ORM solution where you have duplicate ORM tiers.

For the reasons above, this is why we use stored procedures. But if your using stored procedures, which naturally obfuscate the underlying data structures of the database then this increases the impedance mismatch of objects and database entities. One thing about using stored procedures and relying on table locking/row rocking, some of the update scenarios are solved, as we shift the bottle neck to the performance of the underlying database design.

So whats the answer. Don't use objects for databases. Object are great for analysis, bad for code design when interacting with RDBMS databases.

If your really thinking SQL and RDBMS data solutions are a problem, which in some scenarios they are, take a look at some of the NOSQL solutions out there. Still not a panacea for all problems, but in some cases they provide a better solution than a straight SQL solution.

Objects are not the answer to all problems. Step back from your code, take a look at what your trying to do, and think if an object is the right approach.

As for security, no ORMS do not aid security. Although they do help prevent some forms of injection attacks.