Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
YouTube Security VideosGolemDE: Leben als IT-Freiberufler – zwei Perspektiven(24.09.2026 um 07:03 Uhr)
Sichere ProgrammierungOpenChamber 2.0: Skills ändern, Agent läuft weiter(24.09.2026 um 09:04 Uhr)
Sichere ProgrammierungBuilding Enterprise dApps with Smart Contracts and REST APIs(21.09.2026 um 11:34 Uhr)
Sichere ProgrammierungJavaScript Array Methods: 7 Essential Methods Every Developer Needs(24.09.2026 um 08:51 Uhr)
Sichere ProgrammierungCross-Chain Bridge Risk Assessment: Gauntlet(24.09.2026 um 08:53 Uhr)
Sichere ProgrammierungWe spent thirteen weeks about to buy a bigger database(24.09.2026 um 08:54 Uhr)
Sichere ProgrammierungHow to Choose a CDN for Asia in 2026: 7 Providers Compared(24.09.2026 um 08:54 Uhr)
Sichere ProgrammierungMy deploy said Success. It went to a URL nobody visits.(24.09.2026 um 09:00 Uhr)
YouTube Security VideosGolemDE: Leben als IT-Freiberufler – zwei Perspektiven(24.09.2026 um 07:03 Uhr)
Sichere ProgrammierungOpenChamber 2.0: Skills ändern, Agent läuft weiter(24.09.2026 um 09:04 Uhr)
Sichere ProgrammierungBuilding Enterprise dApps with Smart Contracts and REST APIs(21.09.2026 um 11:34 Uhr)
Sichere ProgrammierungJavaScript Array Methods: 7 Essential Methods Every Developer Needs(24.09.2026 um 08:51 Uhr)
Sichere ProgrammierungCross-Chain Bridge Risk Assessment: Gauntlet(24.09.2026 um 08:53 Uhr)
Sichere ProgrammierungWe spent thirteen weeks about to buy a bigger database(24.09.2026 um 08:54 Uhr)
Sichere ProgrammierungHow to Choose a CDN for Asia in 2026: 7 Providers Compared(24.09.2026 um 08:54 Uhr)
Sichere ProgrammierungMy deploy said Success. It went to a URL nobody visits.(24.09.2026 um 09:00 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

I built a 57-line asyncpg wrapper because SQLAlchemy was driving me insane

I came from Rust where I used sqlx — you write raw SQL, you get typed structs back. Simple, honest, fast. Then I had to write Python and reached for SQLAlchemy. Big mistake. Suddenly I was learning a DSL on top of SQL. Debugging what ORM …

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I came from Rust where I used sqlx — you write raw SQL, you get typed structs back. Simple, honest, fast.



Then I had to write Python and reached for SQLAlchemy. Big mistake.



Suddenly I was learning a DSL on top of SQL. Debugging what ORM decided to generate behind my back. Fighting N+1 queries I didn't even know were happening. Writing text() to escape into raw SQL anyway.



So I built EzQL.






What is it?



A minimal wrapper around asyncpg. You write SQL. You get typed Pydantic models back. That's literally it.



The entire core is 57 lines of code.






How it works



Define your model:




from pydantic import BaseModel

class User(BaseModel):
__table__ = "users" # Marks this model as an EzQL model

id: int
name: str





Connect and query:



from ezql import create_client

client = await create_client(
user, password, database, host,
min_connections=2,
max_connections=10
)

# Fire and forget
await client.execute("INSERT INTO users (name) VALUES ($1)", "Nazar")

# Returns List[User] or []
users = await client.query_as(User, "SELECT id, name FROM users WHERE name = $1", "Nazar")

assert users[0].name == "Nazar"
assert isinstance(users[0], User)





No sessions. No .commit(). No magic lazy loading. You know exactly what hits the database.





Joins



For joins you just define a DTO — a plain Pydantic model without __table__:



class UserWithPosts(BaseModel):
# No __table__ — this is a DTO, not a table model
user_name: str
post_title: str

users_with_posts = await client.query_as(UserWithPosts, """
SELECT users.name as user_name, posts.title as post_title
FROM users
JOIN posts ON posts.user_id = users.id
WHERE users.id = $1
""", user_id)





Same approach as sqlx in Rust — separate struct for each query shape. No relationship magic, no hidden queries.




Warning: Always select columns explicitly in joins. SELECT * may cause a ValidationError at runtime since column names can collide across tables.






CLI validator



EzQL also ships with a CLI tool that validates your models against the actual DB schema before you deploy:



ezql ./models --dsn postgresql://user:password@localhost:5432/mydb







Found 1 models. Validating against DB...
Validating User table users
┏━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━┓
Field Model type DB type Status
┡━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━┩
id <class 'int'> │ integer │ ✓ │
│ name │ <class
'str'> │ text │ ✓ │
└───────┴───────────────┴─────────┴────────┘
All models are valid ✓





Catches missing columns, type mismatches, and tables that don't exist — before production blows up.





Why not just use SQLAlchemy?



SQLAlchemy makes sense when:




  • Your team doesn't know SQL

  • You need to support multiple databases simultaneously

  • You're maintaining a legacy codebase that already uses it



Otherwise it's just an extra layer of abstraction you'll eventually punch through with text() anyway.



If you know SQL — just write SQL.





GitHub







GitHub logo

kernz
/
ezql



Why use another bloated ORM when you can interact with your database in the most intuitive and simple way?







EzQL




EzQL - a simple wrapper around asyncpg that makes writing raw SQL in python a little easier



SQLAlchemy is overkill and you need something simpler? Have you tried writing raw SQL in Python but ended up in tears because there's no type safety? Then EzQL is your choice



Why use another bloated ORM when you can interact with your database in the most intuitive and simple way?




Good place to start




PostgreSQL is an open-source relational database beloved by most developers for its reliability, performance, and rich feature set - from advanced indexing and full-text search to JSON support and powerful extensions like PostGIS.



If you're new to PostgreSQL, here are the best places to start:






Example





import asyncio
from pydantic import BaseModel
from ezql import create_client
class User(BaseModel):
__table__ = "users"









Feedback welcome — especially if you find a case where the type mapping breaks.

SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - I built a 57-line asyncpg wrapper because SQLAlchemy was driving me insane
id: 293e2107-364f-433a-a100-f6c7ff41eb45
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "I built a 57-line asyncpg wrap" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich I built a 57-line asyncpg wrapper becaus.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten I built a 57-line asyncpg wrapper because SQLAlchemy was driving me insane

Thematisch verwandte Begriffe: built, 57line, asyncpg, wrapper · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96772 | A security flaw has been discovered in Intelliants Subrion CMS up to 4.2…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick