I like TypeORM but have passed on it for now because of this potential sql injection issue: https://github.com/typeorm/typeorm/issues/3740 I have passed a field to order_by() from the user in Django before. I would be more likely to use a dict now, but I shudder at the thought of accidentally creating an SQL injection bug because I expected to be protected by my ORM.